Autonomy Software Engineer

Zipline•South San Francisco, CA

3h•Onsite

About The Position

This role involves owning the flight-critical runtime responsible for maintaining the safe state of Zipline aircraft. The engineer will architect and implement the autonomy safety layer, which orchestrates missions, detects and diagnoses faults, and executes mitigation and recovery strategies across planning, perception, and controls. This is a deep systems engineering position, primarily using Rust/C++, with strict real-time constraints. The successful candidate will be responsible for making high-judgment design decisions, validating them through SIL/HIL simulations and flight logs, and enhancing the reliability of a global, safety-critical fleet.

Requirements

8+ years building production software for robotics, aerospace, AV, or other safety-critical embedded systems.
Expert in Rust and/or C++ (C as a plus) for real-time, fault-tolerant applications on embedded Linux/RTOS.
Demonstrated systems thinking: clear interface design, resource budgeting, and trade-offs under timing/safety/power constraints.
Hands-on with SIL/HIL, scenario validation, log replay, and fault injection; you measure reliability, not just functionality.
Track record of shipping autonomy features (mission logic, supervision, watchdogs, health monitoring) into noisy, dynamic real-world environments.
Comfort in HW/SW co-design: you can reason about sensors, compute, comms, and actuators well enough to make robust software decisions.
Strong communication and documentation; you make complex safety decisions legible and auditable.

Responsibilities

Design the mission/flight manager: build the state machines and orchestration logic that govern mission sequencing, safe-state transitions, and behavior gating under latency and resource constraints.
Own fault management end-to-end: implement detection, isolation, mitigation, and recovery (FIMR) for sensors, compute, comms, power, and actuation; ensure graceful degradation and continuity of service.
Ship flight-critical Rust/C++: develop and maintain core onboard components with strong observability (health, logs, metrics) and testability (deterministic replay, assertions, invariants).
Prove safety before flight: define success criteria and build the tooling—scenario libraries, SIL/HIL, log-replay harnesses, fault-injection—to validate behaviors across edge cases and long-tail conditions.
Integrate across autonomy: partner with planning, perception, and controls to set interfaces, hazards/assumptions, and escalation paths; codify contracts that the runtime enforces.
Close the loop with operations: turn fleet telemetry and incident reviews into requirements and fixes; drive MTBF/MTTR improvements and intervention-rate reductions.
Lead with systems judgment: write design docs, perform hazard analysis (e.g., FMEA/STPA-style), run design/PR reviews, and mentor engineers on deep-stack ownership.