Formal Methods Engineer for Verified Software

HushOne, Inc.; Kirkland (WA); On-site; USD 140,000 - 210,000; Full time

Benefits offered by this job

Stock options

Four-year vesting

Annual performance bonus

Health insurance

Life and disability insurance

401(k) with company match

AI tokens

Gym membership

Remote-friendly around family

Referral program

Job summary

HushOne, Inc. is seeking a formal-methods expert to ensure robust system design.

You will focus on model authorization, recovery, concurrency, and distributed task state, working with engineers to connect specifications to implementations and surface key assumptions. In the first 90 days, you will formalize a critical protocol, identify counterexamples or prove scoped properties, and add implementation checks.

Qualifications

• Formal-methods expertise with a genuine interest in shipping systems
• Explain the relationship between a proved model, the generated code, and the deployed environment
• Choose where formality pays off rather than trying to verify everything
• Able to work with engineers who do not share your background
• Nice to have: TLA+, Coq, Lean, Dafny or comparable in production use
• Nice to have: Verified cryptographic implementations
• Nice to have: Found a real bug with a formal method

Responsibilities

• Model revocation during failover and identify conditions under which a stale worker could still act
• Model authorization, recovery, concurrency and distributed task state; connect specifications to implementations and make assumptions visible
• In the first 90 days formalize one critical protocol, identify counterexamples or prove scoped properties and add checks

Skills

Formal methods

Explain model-code relationship

Selective verification

Cross-team collaboration

Job description

HushOne, Inc. is seeking a formal-methods expert to ensure robust system design.

You will focus on model authorization, recovery, concurrency, and distributed task state, working with engineers to connect specifications to implementations and surface key assumptions. In the first 90 days, you will formalize a critical protocol, identify counterexamples or prove scoped properties, and add implementation checks.