Staff Software Engineer (Provenance)

In this role you will help build a platform-driven provenance and build information layer for Cloudsmith, enabling end-to-end traceability from source to artifact. You will shape a trust-centric, scalable system that captures, stores, and surfaces provenance data for customers and other platform components. You’ll work closely with cross-functional teams to translate security needs into features that enterprise customers rely on. This is a chance to impact software delivery at scale, contributing to a mission-critical infrastructure in a fast-growing startup.

• equity
• health, dental, and vision insurance
• generous annual leave
• flexible working policies
• professional development budget
• dynamic, innovative work environment

• Design, implement, and ship the provenance ingestion service to accept provenance and attestation payloads from CI/CD, registries, signed bundles, and customer artifacts across formats (SLSA, in-toto, SBOM, Sigstore).
• Own the storage architecture for signed provenance metadata.
• Build the validation engine that checks cryptographic integrity and evaluates attestations against customer trust policies (SLSA, builder identities, key material).
• Expose clean APIs to expose provenance data to customers and platform components (queryable, auditable, reliable).
• Collaborate with product, customer success, and engineering to tailor provenance data for enterprise security teams.
• Prioritize correctness, security, and observability as critical infrastructure for software supply chain decisions.
• Mentor teammates through code reviews, documentation, and open discussions

• 5+ years of production backend engineering with ownership of a complex service end-to-end
• Strong Python experience for backend services and data pipelines
• Familiarity with AWS services (S3, RDS/Postgres, Kinesis, ECS, Lambda) and Terraform
• Data ingestion design for varied, schema-evolving, high-volume payloads with strong observability
• Data modelling skills for signed metadata envelopes, artefact graphs, and queryable relationships
• API design and versioning for external enterprise customers or integrators
• Experience with multi-tenant SaaS platforms including data isolation and audit logging
• Excellent communication and collaborative skills, with a growth mindset

• communication
• collaboration
• curiosity
• Python backend services
• AWS (S3, RDS/Postgres, Kinesis, ECS, Lambda)
• Terraform