Software engineer, AI model supply chain and package security

We build fast modern developer tools in Rust and a surprising amount of serious software runs on them. Pixi rattler and rattler-build are open source and used by hundreds of thousands of developers: quant teams in finance physicists at CERN biotech labs and humanoid robot companies youve probably seen videos of. We are also core maintainers of conda-forge one of the largest open source package ecosystems and we maintain RoboStack which gets ROS running on any OS from a single lockfile.

When that much software flows through your tools security stops being optional. Every package that ends up on a laptop a server or a robot should be traceable back to the source and build that produced it. Were building that for conda today and we want to extend it to AI models.

The engineering team is spread across Europe (Netherlands Germany UK Moldova). This work is based in Berlin and so is this role.

Robots increasingly run learned models: vision transformers RL policies LLMs. Today those models are usually copied onto machines as large opaque files with little record of where they came from or what changed. We think models should be shipped like packages: versioned signed verifiable and updated efficiently.

Youll work on two related areas.

Package security. Signing and verification for conda packages with Sigstore provenance from source to build to install SBOMs and mapping known vulnerabilities onto the packages people actually use. This work goes into Pixi rattler and conda-forge and is used by a lot of people.

AI models as packages. Taking the same ideas to model artifacts. That includes:

• A provenance chain from training through packaging to deployment with signatures that can be verified offline on air-gapped robots

• A model SBOM format building on CycloneDXs ML-BOM

• Delta updates between model versions (full models fine-tunes LoRA adapters quantized variants) so robots dont download gigabytes for a small change

• Compression that combines model techniques (quantization pruning distillation) with what package managers already do well (zstd content-addressable storage) tuned to the target hardware and network

• Managing models that get fine-tuned on the robot itself: tracking where those variants came from validating them and syncing them back

• Testing the whole pipeline end to end on real models and real hardware and measuring latency bandwidth and model quality

A lot of this is new. Part of the job is figuring out which approaches work measuring them honestly and writing up what you found.

You dont need years of experience. You do need solid fundamentals curiosity and the patience to get security details right.

• Rust or a strong background in C Go or Python and the wish to switch

• Interest in software supply chain security. Bonus if youve worked with Sigstore (Cosign Rekor Fulcio) TUF in-toto SLSA or SBOM formats

• Familiarity with ML in practice: youve trained or fine-tuned a model know what a LoRA adapter or a quantized model is and have used PyTorch or similar

• Basic understanding of cryptography as an engineer: signatures hashes certificates and what they do and dont guarantee

• You like measuring things and are honest about results that dont work out

• You live in Berlin or are willing to move here

Its a plus if you know package managers from the inside have worked on model compression or edge inference have robotics experience or have contributed to open source. None of this is required.

Youll work on problems few people have solved yet together with the people who created Mamba Pixi rattler and RoboStack. Most of your work will be open source and used by a large community from day one. We pay a competitive Berlin salary with 30 days of vacation the hardware you want a conference budget and time for upstream open source work. We help with relocation within the EU.