Sandboxing Platform Engineer - Scale-Isolation Systems

Thinking Machines Lab Inc.; San Francisco, Northern (CA, KY); Hybrid; USD 300,000 - 450,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Unlimited PTO

Parental leave

Relocation assistance

Job summary

Thinking Machines Lab is seeking a software engineer to design, build, and operate the sandboxing platform that runs untrusted, model-generated code and tool calls at scale. You will shape isolation boundaries with containers and microVMs, and implement the scheduling and lifecycle systems to manage sandboxes under heavy concurrent load.

Collaborate with researchers and product teams to expose safe primitives, ensuring performance and security.

Qualifications

• Bachelor's degree or equivalent experience in CS, engineering, or similar.
• Proficiency in Python or Rust as a backend language.
• Experience building or operating isolation/virtualization tech like containers, microVMs or sandbox runtimes.
• Strong grounding in Linux internals related to isolation: namespaces, cgroups, seccomp, capabilities, networking.

Responsibilities

• Design, build, and operate sandboxed execution environments for running untrusted, model-generated code and tool calls at scale.
• Improve isolation boundaries using containers, microVMs, or gVisor-style kernels while balancing latency and throughput.
• Build scheduling, resource-management, and lifecycle systems for sandboxes under heavy load.
• Partner with researchers and product teams to expose sandboxing primitives that are easy to use and hard to misuse.
• Instrument sandboxes for observability and abuse detection, respond to new escapes or exploitation attempts.

Skills

Python or Rust

Backend development

Linux internals

Containerization

Collaboration

Education

Bachelor's degree in Computer Science or equivalent

Tools

Kubernetes

gVisor/Kata Containers

Firecracker

Job description

Thinking Machines Lab is seeking a software engineer to design, build, and operate the sandboxing platform that runs untrusted, model-generated code and tool calls at scale. You will shape isolation boundaries with containers and microVMs, and implement the scheduling and lifecycle systems to manage sandboxes under heavy concurrent load.

Collaborate with researchers and product teams to expose safe primitives, ensuring performance and security.