2 days ago
Base Salary
$150k - $180k/yr
Responsibilities
- Lead remediation of high-severity and complex CVEs, including dependency chains and ABI-sensitive packages.
- Assess whether vulnerabilities should be patched, backported, upgraded, or mitigated, and communicate tradeoffs to technical and non-technical stakeholders.
- Design and build automation for CVE intake, package mapping, patching workflows, testing pipelines, and SBOM/VEX generation.
- Define remediation SLAs, metrics, and reporting for exposure and time-to-remediate visibility.
- Partner with upstream maintainers to contribute fixes to the open-source ecosystem.
- Review patches and coach teammates on security fundamentals, correctness, and maintainable design.
- Write design documentation supporting customer-facing security advisories and informed decision-making.
- Use AI-powered development tools to accelerate triage, patch analysis, and testing while maintaining engineering and security rigor.
- Improve the compiled package catalog and build and release pipeline reliability.
- Reduce repetitive engineering work, promote packaging standards and reusable components, and improve build and distribution incident resolution.
Requirements
- 7+ years of professional software engineering experience.
- 3+ years of experience in security remediation, packaging, or release engineering.
- Strong Python expertise and deep C/C++ or equivalent compiled-language experience, including native build and ABI debugging.
- Expert-level experience with conda, wheels, or Linux distribution packaging systems.
- Strong command of CVE/CVSS frameworks, exploitability analysis, and vulnerability scanning tools.
- Demonstrated success designing automation that reduces manual toil at scale.
- Ability to write design documentation and conduct code reviews that clearly communicate tradeoffs.
- Experience coaching or mentoring engineers at any level.
- Proficiency with AI-powered development tools while maintaining strong software engineering fundamentals.
- Preferred: upstream open-source contributions, hands-on CVE remediation, supply chain security involving SBOM, SLSA, signing, or provenance tooling.
- Preferred: experience with open-source ecosystems, package management, build and release engineering, cloud platforms, containers, or GitOps tooling in production.
- Preferred: experience at an AI-focused or data science company and familiarity with security demands for automated workloads at scale.
Benefits
- Fully remote setup with flexible hours.
- Flexible vacation policy.
- Medical, dental, and vision insurance.
- Short-term and long-term disability coverage.
- Paid parental leave.
- Monthly wellness stipend.
- Employee assistance program and mental health resources.
- Annual bonus potential, equity participation, and comprehensive benefits are offered in addition to base salary.
- Applications are reviewed on an ongoing basis until the role is filled, with an application deadline of 12/30/2026.
About Anaconda
Anaconda builds the open-source Anaconda Distribution and conda package manager for Python/R data science, plus enterprise tools for secure package management, governance, and AI workflows. It monetizes through commercial subscriptions, support, and training that help teams manage packages at scale and deploy notebooks and models. Founded in 2012 and headquartered in Austin, Texas, the privately held company also develops Kilo Code, a widely used AI-assisted coding extension for VS Code.