Staff Software Engineer

Salary: £41,000 - 41,000 per year

Requirements

• You know the provenance and attestation landscape, including SLSA, in-toto, Sigstore, DSSE, and how attestations are packaged and signed.
• You are comfortable with signing and verification, including key material, ECDSA/RSA, certificate chains, OIDC-based keyless signing flows, and transparency logs.
• You are familiar with CycloneDX and SPDX, and how they are packaged as attestation artifacts.
• You have 5+ years of production backend engineering experience, with real ownership of at least one complex service end-to-end.
• You have strong experience with Python for building backend services and data pipelines.
• You are familiar with AWS services such as S3, RDS/Postgres, Kinesis, ECS, and Lambda, as well as infrastructure tooling such as Terraform.
• You have experience designing pipelines that handle varied, schema-evolving, high-volume payloads reliably and at scale, including robust error handling and observability.
• You can design storage schemas that efficiently represent signed metadata envelopes, artifact graphs, and queryable relationships.
• You have experience building and versioning APIs consumed by external enterprise customers or third-party integrators.
• You have built or operated multi-tenant SaaS platforms and understand data isolation, access control, and audit logging in practice.
• You understand the importance of shipping early and often and are comfortable making real-world trade-offs.
• You are an effective communicator who can bridge the gap between technical and non-technical stakeholders.
• You are deeply passionate about your craft, eager to learn, and comfortable admitting what you do not yet know.

Responsibilities

• We design, implement, and ship the provenance ingestion service, capable of accepting provenance and attestation payloads from CI/CD systems, public registries, signed bundles, and customer-uploaded artifacts across a wide range of formats.
• We own the storage architecture for signed provenance metadata.
• We build the validation engine that verifies cryptographic integrity and evaluates attestation data against configurable customer trust policies.
• We deliver clean, well-documented APIs that make provenance data useful to customers and to other parts of the platform.
• We work closely with product, customer success, and the wider engineering team to understand how enterprise security teams consume provenance data and translate that into features they love.
• We prioritize correctness, security, and observability as critical infrastructure.
• We share our expertise across the team through code reviews, documentation, and open conversation.

Technologies

• AWS
• Lambda
• Backend
• CI/CD
• Cloud
• Support
• Python
• Security
• Terraform
• Web
• API
• DevOps
• Slack

More

Cloudsmith is transforming how organizations handle software artifacts and secure their supply chains. We are a cloud native, multi-tenant platform that helps organizations build software better through artifact management and software supply chain security. We support over 30 formats across languages, container formats, and operating systems, with enterprise-grade vulnerability and security scanning, policy management and enforcement, and web-scale performance. We are backed by top-tier investors and are on a trajectory toward IPO and beyond. This role sits on our Supply Chain Trust team, building platform capability that gives enterprise customers complete end-to-end traceability from source code to built artifact. We are four collaborative teams working in a modern CI/CD environment, deploying multiple times per day, and supporting a global customer base. We are headquartered in Belfast, Northern Ireland, with office space open 24x7, and many of us work remotely. We offer a competitive compensation package including equity, health, dental, and vision insurance, generous annual leave, flexible working, professional development support, and opportunities to shape a fast-growing Series B startup. You must be based in Ireland or the United Kingdom and have the right to work independently without requiring sponsorship.

last updated 35 week of 2026