Staff Software Engineer: Provenance & Supply Chain Platform

We are looking for an engineer to help build a new generation of provenance and build information into the Cloudsmith platform. If you are motivated by solving problems of performance at a massive scale and passionate about your craft, you will find an environment in which you can thrive at Cloudsmith.

Cloudsmith is transforming how organizations handle software artifacts and secure their supply chains. As a cloud native, multi-tenant platform, we enable organizations to build software better, through best-in-class artifact management and software supply chain security. Our vision is to become the software supply chain itself, powering the future of software delivery.

As a Staff Software Engineer on the Supply Chain Trust team, you will play a key role in building platform capability that gives enterprise customers complete, end-to-end traceability from source code to built artifact. You will build the infrastructure that captures, stores, and surfaces build provenance and pipeline usage data.

Our Team consists of four teams responsible for building application capabilities and the underlying platform upon which Cloudsmith is founded. We operate in a highly collaborative environment, where people with different skills come together to make things happen.

Key Responsibilities

• Design, implement, and ship the provenance ingestion service — capable of accepting provenance and attestation payloads from CI/CD systems, public registries, signed bundles, and customer-uploaded artifacts across a wide range of formats.
• Own the storage architecture for signed provenance metadata.
• Build the validation engine that verifies cryptographic integrity and evaluates attestation data against configurable customer trust policies.
• Deliver clean, well-documented APIs that make provenance data useful to customers and to other parts of the platform.
• Work closely with product, customer success, and the wider engineering team to understand how enterprise security teams consume provenance data.
• Prioritise correctness, security, and observability.
• Share your expertise across the team through code reviews, documentation, and open conversation.

Required Experience, Qualities & Skills

• Provenance & Attestation: Knowledge of SLSA, in-toto, Sigstore, DSSE, and how attestations are packaged and signed.
• Cryptographic Foundations: Comfortable with signing and verification.
• SBOM Formats: Familiarity with CycloneDX and SPDX.
• 5+ years of production backend engineering experience.
• Strong experience with Python for building backend services and data pipelines.
• Experience designing pipelines that handle varied, schema-evolving, high-volume payloads reliably and at scale.
• Ability to design storage schemas that efficiently represent signed metadata envelopes.
• Experience building and versioning APIs consumed by external enterprise customers.
• Experience with multi-tenant SaaS platforms.
• Understanding of the importance of shipping early and often.
• Effective communication skills.
• Passionate about your craft and eager to learn.

Benefits, Location & Work Environment

• A position based in Ireland or the United Kingdom.
• A competitive compensation package, including equity.
• Comprehensive health, dental, and vision insurance.
• Generous annual leave and flexible working policies.
• Professional development budget for conferences and training.
• Dynamic, innovative, trust-centric, and supportive work environment.
• Regular travel may be required for team meetings and events.

Cloudsmith is an equal-opportunity employer proud to nurture a diverse workplace that welcomes applications from individuals of all races, genders, and ethnic groups. We do not discriminate on age, religion, sexual orientation, citizenship status, military service, or health conditions.

We’re looking for someone who has a passion for their craft, a collaborative attitude, and a desire to build a product customers love.