Staff Software Engineer (Provenance)

SLAMcore; United Kingdom; On-site; GBP 70,000 - 90,000; Full time

Benefits offered by this job

Equity

Comprehensive health insurance

Professional development budget

Flexible working policies

Generous annual leave

Job summary

Cloudsmith is seeking a Staff Software Engineer to join our Supply Chain Trust team in the UK. This role involves building capabilities for end-to-end traceability in software artifacts, focusing on provenance and attestation. Key responsibilities include designing the ingestion service, owning storage architecture, and validating data. The ideal candidate has over 5 years of experience in backend engineering, especially with Python and AWS. Cloudsmith offers a competitive compensation package, health benefits, and a supportive work environment that values personal growth.

Qualifications

• Experience with SLSA, in-toto, and Sigstore.
• Familiarity with CycloneDX and SPDX.
• Strong experience with Python for backend services.
• Experience designing data ingestion pipelines.

Responsibilities

• Design, implement, and ship the provenance ingestion service.
• Own the storage architecture for signed provenance metadata.
• Build the validation engine for attestation data.
• Deliver well-documented APIs for provenance data.
• Collaborate with product and engineering teams.
• Prioritize correctness, security, and observability.
• Mentor team members through code reviews and knowledge sharing.

Skills

Provenance & Attestation

Cryptographic Foundations

SBOM Formats

Backend Engineering

API Design

Communication

Iterative Delivery

Education

5+ years of production backend engineering

Tools

Python

AWS services

Terraform

Job description

TL;DR: We are looking for an engineer to help build a new generation of provenance and build information into the Cloudsmith platform. If you are motivated by solving problems of performance at a massive scale and passionate about your craft, you will find an environment in which you can thrive at Cloudsmith.

The Role

A Staff Software Engineer on the Supply Chain Trust team, you will play a key role in building platform capability that gives enterprise customers complete, end-to-end traceability from source code to built artifact. Not just where an artifact came from, but how it was built, what went into it, and exactly how it was used across every pipeline and deployment downstream.

Cloudsmith already sits in the middle of how organisations store and distribute software artifacts. This role turns that position into something more powerful: a source of truth. You will build the infrastructure that captures, stores, and surfaces build provenance and pipeline usage data — so that when a customer asks which of their services consumed a given artifact, and what build produced it, the answer is in Cloudsmith, complete and trustworthy.

Our Team

We are four teams responsible for building application capabilities and the underlying platform upon which Cloudsmith is founded. We operate in a highly collaborative environment, where people with different skills come together to make things happen. We each contribute to an environment where curiosity, support, transparency, and bias for action reign. We have a modern CI/CD approach, deploying multiple times per day, and we support a global set of customers who are engineers like us.

Key Responsibilities

• Build: Design, implement, and ship the provenance ingestion service — capable of accepting provenance and attestation payloads from CI/CD systems, public registries, signed bundles, and customer-uploaded artifacts across a wide range of formats (SLSA, in-toto, SBOM attestations, Sigstore bundles etc).

• Store: Own the storage architecture for signed provenance metadata.

• Validate: Build the validation engine that verifies cryptographic integrity and evaluates attestation data against configurable customer trust policies — SLSA level requirements, allowed builder identities, key material, and more.

• Expose: Deliver clean, well-documented APIs that make provenance data useful to customers and to other parts of the platform — queryable, auditable, and reliable.

• Collaborate: Work closely with product, customer success, and the wider engineering team to understand how enterprise security teams consume provenance data and translate that into features they love.

• Quality: Prioritise correctness, security, and observability — this is critical infrastructure customers trust with their software supply chain decisions.

• Mentor: Share your expertise across the team through code reviews, documentation, and open conversation — a rising tide lifts all boats.

Required Experience, Qualities & Skills

We realise that not everyone will have every experience and expertise in every possible thing. Still, if you have many of the following, we might be a great place to progress your career.

Domain Knowledge

• Provenance & Attestation: You know the landscape: SLSA, in-toto, Sigstore, DSSE, and how attestations are packaged and signed. You do not need to have built signing pipelines, but you must understand their output.

• Cryptographic Foundations: Comfortable with signing and verification: key material, ECDSA/RSA, certificate chains, OIDC-based keyless signing flows, and transparency logs.

• SBOM Formats: Familiarity with CycloneDX and SPDX, and how they are packaged as attestation artifacts.

Backend & Platform Engineering

• Experience: 5+ years of production backend engineering, with real ownership of at least one complex service end-to-end.

• Technical Proficiency: Strong experience with Python for building backend services and data pipelines. Familiarity with AWS services (e.g. S3, RDS/Postgres, Kinesis, ECS, Lambda) and infrastructure tooling (Terraform).

• Data Ingestion: Experience designing pipelines that handle varied, schema-evolving, high-volume payloads reliably and at scale — including robust error handling and observability.

• Data Modelling: Ability to design storage schemas that efficiently represent signed metadata envelopes, artefact graphs, and queryable relationships.

• API Design: Experience building and versioning APIs consumed by external enterprise customers or third-party integrators.

• Multi‑Tenant Systems: You have built or operated multi-tenant SaaS platforms and understand what data isolation, access control, and audit logging actually require in practice.

• Iterative Delivery: You understand the importance of shipping early and often and are comfortable making real-world trade-offs between a perfect design and getting something valuable in front of customers.

• Communication: You are enthusiastic and effective communicator who can bridge the gap between technical and non-technical stakeholders.

• Mindset: You are deeply passionate about your craft, eager to learn, and comfortable admitting what you don't yet know.

Benefits, Location & Work Environment

Note: You must be based in Ireland or the United Kingdom and have the right to work independently without requiring sponsorship.

Headlines

• A position based in Ireland or the United Kingdom.
• A competitive compensation package, including equity.
• With comprehensive health, dental, and vision insurance.
• Plus, generous annual leave and flexible working policies to suit your lifestyle.
• Including a professional development budget for conferences and training.
• In a dynamic, innovative, trust‑centric, and supportive work environment.
• With the opportunity to shape a fast‑growing Series B startup (and beyond).
• Regular (monthly-ish) travel may be required for team meetings.
• Regular (quarterly-ish) travel may also be required for events and customers.

Health and Wellness

Regardless of your location, we deeply care about the health and wellness of our staff and their families; a sustainable pace is important to us. In addition to generous annual leave (PTO), we offer health and well‑being benefits along with flexible family‑friendly working policies.

Personal Growth

You will have an enormous opportunity to learn new skills alongside your colleagues, and your continued professional development is essential to us because it's important to you. We will support you with budgets for equipment, training, books, conferences, travel, and certifications. The more powerful you become, the better for all of us.

Facilities

Cloudsmith is headquartered in Belfast, Northern Ireland, with fully‑equipped office space that’s open 24x7. We use our H.Q. regularly for activities like working sessions, team planning, meets and greets, and sometimes other group activities (like games!). We also hold all‑hands off‑sites in Belfast twice a year, featuring guest speakers and team activities. Many Cloudsmithers work remotely, so we rely on our online collaboration tools; Slack, Google Docs, Linear, and other popular collaboration tools are how we work.

About Equal Opportunity

Cloudsmith is an equal‑opportunity employer proud to nurture a diverse workplace that welcomes applications from individuals of all races, genders, and ethnic groups. We do not discriminate on age, religion, sexual orientation, citizenship status, military service, or health conditions. We will not tolerate discrimination of any kind within our workforce.

The Final Word

We’re looking for someone who has a passion for their craft, a collaborative attitude, and a desire to build a product customers love. We are critical infrastructure built by developers for developers, and we are building the world’s software supply chain platform and ecosystem. We want to hear from you if you are excited to build the edge networking layer that powers software delivery at a global scale—balancing thoughtful design with real‑world constraints—to leave a lasting impact on the software industry from today until IPO and beyond.