Staff Software Engineer

About the Role

At Anthropic, we're building frontier AI systems that require unprecedented levels of security and isolation. We're seeking a Staff Software Engineer specializing in container and VM security to help us design and implement robust sandboxing solutions that protect our AI infrastructure from untrusted workloads while maintaining performance and usability.

In this role, you'll be at the forefront of securing our serverless container infrastructure at scale. You'll develop comprehensive threat models for complex distributed systems, design pragmatic security measures across the stack, and build layers of defenses that can withstand the most sophisticated attacks. Your work will be critical in ensuring that our systems remain secure as we scale to support increasingly more powerful agentic workloads.

Responsibilities

• Design comprehensive threat models for multi-tenant container infrastructure, identifying attack vectors across tenant isolation boundaries, API surfaces, and data flows
• Develop and implement security policies and controls for sandboxing environments, ensuring strong isolation between different customer workloads
• Build security architectures that address tenant-to-tenant attacks, privilege escalation, and data exfiltration risks in distributed systems
• Create defense-in-depth strategies that combine network segmentation, identity and access management, and runtime security controls
• Partner with infrastructure and product teams to implement secure-by-default patterns for deploying AI workloads in multi-tenant environments
• Develop monitoring and detection capabilities to identify potential security breaches, anomalous behavior, or policy violations across tenant boundaries
• Design and implement automated security testing frameworks to continuously validate isolation properties and security controls
• Mentor other engineers on secure coding practices, threat modeling methodologies, and security architecture principles
• Contribute to security incident response efforts
• Collaborate with research and product teams to understand the unique security requirements of AI workloads and develop appropriate security strategies

You may be a good fit if you:

• Have 8+ years of experience in security engineering, with deep expertise in securing multi-tenant infrastructure
• Possess expert-level knowledge of threat modeling methodologies and have a proven track record of applying them to complex distributed systems
• Have extensive experience securing serverless computing platforms or edge compute environments
• Understand the security challenges specific to multi-tenant SaaS platforms, including tenant isolation, data segregation, and API security
• Are proficient in multiple programming languages (e.g., Go, Rust, Python, TypeScript) with experience implementing security controls
• Have hands-on experience with cloud-native security tools and services (AWS IAM, Security Groups, WAF, Cloud Security Posture Management)
• Can design and articulate complex threat models, clearly communicating risks and mitigations to both technical and non-technical stakeholders
• Have experience with zero-trust security architectures and their implementation in cloud environments
• Thrive in ambiguous environments and can balance security requirements with business needs and developer experience
• Communicate effectively about security risks, making complex technical concepts accessible to diverse audiences

Strong candidates may also have:

• Experience working at a serverless platform provider or edge compute company
• Deep knowledge of function-as-a-service (FaaS) security challenges and mitigation strategies
• Experience with container security and orchestration platforms (Kubernetes, ECS, Cloud Run)
• Understanding of AI/ML workload characteristics and their unique security requirements in multi-tenant settings
• Contributions to open-source security projects or responsible disclosure of security vulnerabilities in serverless platforms
• Experience with Infrastructure as Code security (Terraform, CloudFormation, Pulumi) and policy-as-code frameworks (OPA, Sentinel)
• Background in security research, formal verification, or security tooling development
• Knowledge of compliance frameworks (SOC 2, ISO 27001, FedRAMP) and their application to multi-tenant architectures
• Experience with runtime application security (RASP, IAST) or cloud workload protection platforms (CWPP)
• Experience penetration testing code execution environments

Representative projects:

• Designing a comprehensive threat model for our multi-tenant sandboxing platform, identifying and mitigating risks across network, data, and control planes
• Implementing a policy framework that enforces tenant isolation while allowing secure resource sharing where appropriate
• Building automated security testing that validates tenant isolation properties across API boundaries and data stores
• Creating secure defaults and guardrails for serverless function deployments to prevent common security misconfigurations
• Developing a runtime security monitoring system that detects anomalous cross-tenant access patterns or data exfiltration attempts
• Architecting network isolation strategies using VPC, security groups, and service meshes to segment multi-tenant workloads