You make the most important guarantees precise enough to check, focusing formal reasoning on the boundaries where a mistake is expensive. The honest version of this role includes being clear about the gap between a proved model, the code generated from it, and the environment it actually runs in.
Open for applications. Starts at: Research program.
We are taking applications for this role now and building the pipeline for it. The stage above is when the work itself is expected to begin, which is something you deserve to know before you apply rather than after. It is context, not a gate.
Where
In the office together five days a week, in one of our garages, and remote-friendly around your family, arranged one person at a time. We hire across the United States 🇺🇸, India 🇮🇳 and the UAE 🇦🇪.
The work
Model authorization, recovery, concurrency and distributed task state. Use model checking, proof assistants or program analysis where they add practical assurance. Work with engineers to connect specifications to implementations and make assumptions visible.
The milestone
In your first 90 days, formalize one critical protocol, identify counterexamples or prove scoped properties, and add implementation checks.
Required
Nice to have
Evidence
Bring formal-methods expertise with an interest in shipping systems. Explain the relationship between a proved model, generated code and the actual deployed environment.
Evidence, not credentials. We are describing work you can point at, in whatever form it exists.
The exercise
Model revocation during failover and identify conditions under which a stale worker could still act.
The package
Indicative pay ranges by market and level are on the compensation page. Plan numbers are confirmed in your offer letter.
Apply
One short form. A person reads every application and you hear back either way. You will get your own link to check where things stand, and you can withdraw or delete your application from it at any time, without an account.
