Senior Software Engineer, Agent Policy Fabric

NVIDIA•Us, CA

22h

About The Position

The Agentic Safety Engineering team is building Agent Policy Fabric (APF), an enterprise governance layer for AI agents. APF combines signed policy, runtime verification, policy projection, credential mediation, and audit records to help govern agent actions across enterprise systems. The Senior Software Engineer will help turn the APF proof of concept into production software by building, implementing, testing, and operating features in policy verification, runtime integration, or conformance testing. The engineer will own a defined feature or subsystem and work with experienced platform and security engineers to ensure policy decisions are accurate, integrations reliable, and failures handled safely. The role includes implementing policy-verification features and authorization APIs; translating canonical policies into runtime-specific rules; developing runtime integrations; strengthening correctness through conformance and adversarial testing; and delivering production-ready components with observability, performance measurement, operational documentation, and rollout planning. The engineer will also write design documents, communicate tradeoffs, participate in code and security reviews, collaborate with platform, Identity, and Product Security partners, and help the team manage dependencies and risks.

Requirements

Bachelor's degree or equivalent experience.
At least 5 years of relevant industry experience in systems software, backend services, distributed systems, security engineering, or policy infrastructure.
Strong programming skills in at least one of Rust, Go, C++, or Python, with experience delivering maintainable, tested production code.
Experience building and delivering services or systems components, including API design, integration, debugging, and error handling.
Practical experience implementing security controls such as authorization checks, signature verification, or credential handling, and ability to reason about trust boundaries and safe failure behavior.
Working knowledge of Linux, service-to-service interfaces, automated testing, CI, and software release workflows.
Ability to own engineering work through design, implementation, validation, and delivery; communicate technical tradeoffs clearly; and collaborate effectively through design and code reviews.

Nice To Haves

Experience with policy engines or authorization systems such as OPA/Rego, Cedar, Zanzibar-style systems, or runtime enforcement frameworks.
Experience with signed artifacts, trust-root distribution, key rotation, revocation, or tools such as Sigstore, TUF, or in-toto.
Familiarity with AI-agent runtimes, sandboxed execution, tool-call governance, MCP-style routing, or credential isolation.
Experience with protobuf/gRPC, schema evolution, backward-compatible APIs, or cloud and enterprise deployment environments.
Use of property testing, fuzzing, or other adversarial testing techniques to find security and correctness defects.

Responsibilities

Implement Runtime Policy Verifier and authorization API features, including signed policy validation, freshness and revocation checks, rollback protection, and binding decisions to the correct subject and runtime context.
Translate canonical APF policies into runtime-specific rules and adapter constraints, safely handling unsupported policies and partial updates so runtimes admit work only after required policy is accepted.
Implement and test agreed interfaces for policy consumption, runtime context, admission decisions, and audit events with OpenShell and other runtime engineers.
Document interface behavior and raise gaps or conflicting assumptions for resolution.
Build fixtures, compatibility tests, negative tests, and property or fuzz tests covering policy behavior, integration boundaries, and failure paths.
Investigate defects and create regression coverage based on findings.
Add observability, measure performance, debug reliability issues, and contribute to rollout plans and operational documentation for owned components.
Write focused design documents, explain implementation tradeoffs, participate in code and security reviews, and work with platform, Identity, and Product Security partners to resolve issues within scope.
Break work into achievable milestones, communicate dependencies and risks, review code, and share knowledge with other engineers.