Principal Engineer - Ledger Core

MSCI Inc; New York (NY); On-site; USD 180,000 - 260,000; Full time

Job summary

MSCI Inc. is seeking a seasoned engineer to design and defend the single invariant that money is neither created nor destroyed as it moves through the system.

You will shape the Ledger Core, an immutable event store that underpins all metrics and valuations across asset classes. You will own storage design, the money model with integer minor units, and the commit protocol, ensuring defensible cores over feature growth.

Qualifications

• 8+ years building high-integrity storage or ledger systems in production.
• Deep fluency in a modern, type-safe systems language (Go, Rust, or similar).
• Hands-on experience with event sourcing and append-only log architectures at scale.
• Working command of MVCC, vector clocks, and consistent-cut / distributed-snapshot theory.
• Bias toward minimal, defensible cores over feature creep.

Responsibilities

• Storage design: the append-only prefix-KV layout underneath the event log, optimized for write-once, read-many access patterns and long-horizon replay.
• The money model: integer minor units, Int128 arithmetic, and versioned units to avoid rounding / drift in the book of record.
• Conservation invariant: exact-integer check enforced at the commit point.
• Commit protocol: vector-clock based commit ordering and consistent-cut semantics across concurrent writers.
• Core boundary discipline: decide what stays inside the immutable kernel versus what is pushed out to plug-in and quant services.
• Develop specs and property tests for agentic contributions to the core safe-guarding.

Skills

High-integrity storage

Ledger systems

Event sourcing

MVCC

Vector clocks

Distributed-snapshot theory

Tools

Go

Rust

Prefix-KV store

Int128 arithmetic

Job description

You will design and defend the single most important invariant that every quant model on this team ultimately depends on: that money is never created or destroyed as it moves through the system. The Ledger Core is the immutable, append-only, bi-temporal event store that every return, risk figure, and valuation traces back to. This role sets the boundary of the core itself, deciding with precision what belongs inside a small, provably correct kernel and what belongs outside it, and holds that line as the platform scales across asset classes and consuming teams.

What You'll Own

• Storage design: the append-only prefix-KV layout underneath the event log, optimized for write-once, read-many access patterns and long-horizon replay.
• The money model: integer minor units, Int128 arithmetic, and versioned units, so that no rounding or float-drift error can ever enter the book of record a quant model would otherwise inherit.
• Conservation invariant: an exact-integer check enforced at the commit point, not reconciled after the fact.
• Commit protocol: vector-clock based commit ordering and consistent-cut semantics across concurrent writers.
• Core boundary discipline: the ongoing judgment call of what stays inside the immutable kernel versus what is pushed out to plug-in and quant services.

Agentic Development Expectation

This role sets the standard for how the rest of the team uses AI coding agents against the core. Because the ledger's correctness surface is small and its blast radius is large, you will define which parts of the core are safe to delegate to agentic implementation against a written invariant, and which parts require a human holding the pen. Expect to spend real time writing the specs and property tests that make agentic contribution to the core safe rather than expanding scope to accommodate it.

Required Background

• 8+ years building high-integrity, low-level storage or ledger systems in production, ideally in financial infrastructure, payments, or exchange-grade systems.
• Deep fluency in a modern, type-safe systems language (Go, Rust, or similar), with the ability to reason precisely about memory layout, allocation, and concurrency primitives.
• Hands-on experience with event sourcing and append-only log architectures at scale.
• Working command of MVCC, vector clocks, and consistent-cut / distributed-snapshot theory, not just familiarity with the terms.
• A demonstrated bias toward minimal, defensible cores over feature-accreting ones; you can point to a system where you said no to scope and were right to.

Preferred / Bonus

• Prior ownership of a ledger, general ledger engine, or exchange matching/settlement core.
• Experience with formal or semi-formal invariant specification (TLA+, Alloy, or comparable).
• Exposure to private markets or fund accounting data models.