Virtualization Engineer

## About the company We are building the cloud compute layer for the agent age: think AWS or GCP, but designed around AI agents as first-class cloud users. Existing cloud primitives were designed for humans clicking consoles or writing static IaC, not for autonomous agents that need to spin up environments, run untrusted code, and manage its own resources at runtime. We are venture-backed and led by three technical co-founders with backgrounds in high-frequency trading, ML engineering, and quantitative research. No recruiters, but we welcome every referral. ## The Role You will own the virtualization and isolation layer of the platform. Today we use Firecracker microVMs. Tomorrow we may need gVisor for density, QEMU for compatibility, custom hypervisor work for features that don't exist yet, or multiple backends for different workload profiles. You will make those calls and build what's needed. The work spans hypervisor integration, guest-agent protocols, snapshot/restore, fork semantics, memory management, Linux networking, and the boundary where virtualization constraints become product tradeoffs. If you want to own a virtualization stack end-to-end, not just use someone else's, this is the role. ## What You'll Own - Isolation backend selection and implementation for different workload profiles. - Runtime lifecycle (boot, exec, suspend, resume, fork, destroy): correctness, latency budgets, and failure handling. - Host/guest contract: the protocol between host-agent and guest-agent that the rest of the platform depends on. - Per-sandbox networking: TAP devices, NAT, port forwarding, and tenant isolation. - Guest image pipeline: rootfs, kernels, templates, init systems. - Snapshot and fork: storage, restore latency, and consistency under load. - Security posture: isolation boundaries, escape prevention, seccomp, resource limits. ## You Are A Fit If - You can write code and you use AI tools daily to amplify your output. You direct it well, understand what it produces, and know when it's wrong. If you're not AI-native, this isn't the right role. - You have worked at the hypervisor or kernel level, not just consumed virtualization as a service. - You can debug below the abstraction: trace a guest failure through the VMM to the host kernel. - You have made build-vs-adopt decisions on isolation tech and lived with the consequences. - You think about security as a design constraint, not a checklist. - You communicate clearly and keep the team informed. When something breaks, people hear it from you first. - You stay constructive when requirements change. Uncertainty doesn't block you. - You think about the business, not just the code. You spot opportunities, seek out the actual workflow, and prototype solutions within constraints. ## Useful Experience - Virtualization: Firecracker, QEMU, KVM, Cloud Hypervisor, gVisor, Kata Containers. - Hypervisor internals: Device models, memory management, CPU virtualization, custom VMMs. - Rust, C, or C++ at the hypervisor or kernel level. - Linux internals: namespaces, cgroups, seccomp, filesystems, networking, memory management. - Snapshotting: CRIU, userfaultfd, lazy restore, memory snapshotting. - Security: Isolation boundaries, escape analysis, sandboxing, multi-tenant architecture. ## What we Offer - Competitive salary in the geographies we hire in, plus meaningful early-stage equity. - Shape the virtualization and isolation layer of a high-potential startup from day one. - High autonomy, high trust. You get a problem and the space to solve it, not a task list. - A small team where everyone wears multiple hats, with direct access to founders. - Distributed across Singapore and Europe; self-sufficient, async-friendly.