Software Engineer - Platform Security
Design and build Mosaico's security module from scratch, covering auth, authorization, and secure gRPC, in Go, as a founding member of a small team shipping the commercial platform.
Mosaico is an open-source data platform for robotics and physical AI. We’re solving a hard infrastructure problem: the tools that exist today for storing, indexing, and retrieving high-frequency sensor data are either too primitive or too painful to work with at scale.
We’re building the missing piece, and doing it in the open. Apache 2.0 licensed, public roadmap, real community. We care about the codebase being something people actually want to read and contribute to, not just use.
We’re based in Reggio Emilia, working with teams in defence, automotive, and agritech, and we’re building a commercial offering on top of the open-source core.
The role
We’re looking for a Software Engineer to join a focused team building a new security module from scratch. This module will be part of Mosaico’s commercial offering, so it needs to meet a high bar both technically and in terms of developer experience.
There’s substantial design work ahead before a single line of production code gets written: threat modeling, API surface design, permission semantics, token lifecycle, and integration patterns with the rest of the platform. If you enjoy thinking hard about a problem before solving it, this is that kind of role.
The module integrates directly with mosaicod via gRPC, so you’ll be working with Protocol Buffers, service definitions, and the specifics of securing gRPC communication in a high-throughput systems environment. You’ll work closely with the team building the Rust core, so comfort reading and reasoning about systems-level code matters even if Go is your primary language.
What you’ll work on
- Co-design the architecture of the new module alongside the rest of the team, from threat model to API contracts
- Implement a Go service that integrates with mosaicod via gRPC and is consumed by SDK clients
- Design and implement secure gRPC communication patterns: channel security, interceptors, metadata-based auth propagation
- Define and document security primitives: authentication flows, authorization models, token management, key lifecycle
- Contribute to code review and help establish engineering standards for the module
- Work across a polyglot stack (Go, Rust, Python) and interface with both internal platform components and external integrations
What we’re looking for
- Solid Go experience, including production services and idiomatic patterns
- Strong grounding in information security: authentication protocols (OAuth2, OIDC, JWT), authorization models (RBAC, ABAC), cryptographic primitives, secure API design, and common attack surfaces
- Hands-on experience with gRPC and Protocol Buffers, including service design and securing gRPC endpoints in production
- Ability to contribute to system design, not just implementation: you should be comfortable whiteboarding permission models and arguing about tradeoffs
- Experience building or operating security-sensitive services in production
- Autonomous and rigorous: this is a small team, so ownership matters
- Fluent in English, written and spoken
Nice to have
- Experience with Rust or genuine interest in learning it
- Background in distributed systems or data infrastructure
- Familiarity with secrets management, PKI, or hardware security primitives
- Experience with Apache Arrow (which gRPC underpins in our stack)
- Open-source contributions
What we offer
- Significant design ownership: architecture, API contracts, security model
- Work that ships as part of a commercial product used by robotics and physical AI teams across defence, automotive, and agritech
- Flexible hours, full remote with optional office access in Reggio Emilia
- Competitive salary, discussed openly based on your level and experience
- Welfare package
- Stock options
Salary range
€45K – 60K, adjusted based on location, experience, and level.
Contacts
Interested? Write to [email protected]