> Markdown version of [/jobs/ext/4374310-software-engineer-sandboxing](https://www.wearedevelopers.com/jobs/ext/4374310-software-engineer-sandboxing). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Software Engineer, Sandboxing

- **Company:** Thinking Machines Lab Inc.
- **Location:** New York, NY, United States
- **Salary:** $300,000.0 - $350,000.0
- **Contract:** Permanent contract
- **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Cloud Computing, Computer Programming, Hypervisor, Python (Programming Language), Linux Kernel, Open Source Technology, Software Engineering, System Programming, Virtualization Technology, Backend, Agentic-AI, Kubernetes, Information Technology, Api Design
- **Published:** October 26, 2026
- **Apply:** https://www.careerbuilder.com/job-details/software-engineer-sandboxing-new-york-ny--f17fd49c-5414-490a-9301-9e29f7167f68

## About the Role

Software Engineering, Artificial Intelligence (AI), Software Engineering, Technical Recruiting, Startup, Kernel Programming, Resource Management, Application Programming Interface (API), Virtualization, Computer Science, * Bachelors degree or equivalent experience in computer science, engineering, or similar.

 * Proficiency in at least one backend language (we use Python or Rust).
 * Experience building or operating isolation or virtualization technology, such as containers, microVMs (e.g. Firecracker, Cloud Hypervisor), or sandboxed runtimes (e.g. gVisor, Kata Containers).
 * Solid grounding in Linux internals relevant to isolation: namespaces, cgroups, seccomp, capabilities, and networking.
 * Comfort operating across the stack and owning projects end-to-end.
 * Thrive in a highly collaborative environment involving many, different cross-functional partners and subject matter experts., * Experience securing systems that execute untrusted or adversarial code, including threat modeling and hardening against sandbox escapes.
 * Familiarity with running large-scale, multi-tenant infrastructure on Kubernetes or similar orchestration systems.
 * Experience with performance-sensitive systems programming and reducing cold-start latency for ephemeral compute.
 * Track record of contributing to open-source infrastructure or security tooling.
 * Interest in how AI agents use tools and code execution, and how that shapes the design of safe execution environments.

## Description

Our models and agents increasingly need to run code, use tools, and take actions in the world - safely, reliably, and at scale. The Core Services team builds the sandboxing infrastructure that makes this possible: the isolated execution environments where models write and run code, browse, and interact with tools, both for our researchers during training and for external users building on Tinker.

Were hiring a software engineer to help design, build, and operate this sandboxing platform. Youll work on the systems that isolate and constrain untrusted, model-generated code, and that scale to support thousands of concurrent executions across the company. This is foundational infrastructure: every research experiment and every product surface that lets a model take action depends on it being fast, secure, and dependable.

What Youll Do

 * Design, build, and operate sandboxed execution environments for running untrusted, model-generated code and tool calls at scale.
 * Improve isolation boundaries using technologies such as containers, microVMs, or gVisor-style kernels, balancing security against startup latency and throughput.
 * Build the scheduling, resource-management, and lifecycle systems that provision, reuse, and tear down sandboxes efficiently under heavy concurrent load.
 * Partner with researchers and Tinkers product team to expose sandboxing primitives that are simple to use and hard to misuse.
 * Instrument sandboxes for observability and abuse detection, and respond to novel escape or exploitation attempts as theyre discovered.
 * Own reliability and performance of the sandboxing platform end-to-end, from API design down to the underlying virtualization layer.