Staff Software Engineer
Sonatype is the software supply chain security company. We provide the world’s best end-to-end software supply chain security solution, combining the only proactive protection against malicious open source, the only enterprise grade SBOM management and the leading open source dependency management platform. This empowers enterprises to create and maintain secure, quality, and innovative software at scale.
As founders of Nexus Repository and stewards of Maven Central, the world’s largest repository of Java open-source software, we are software pioneers and our open source expertise is unmatched. We empower innovation with an unparalleled commitment to build faster, safer software and harness AI and data intelligence to mitigate risk, maximize efficiencies, and drive powerful software development.
More than 2,000 organizations, including 70% of the Fortune 100 and 15 million software developers, rely on Sonatype to optimize their software supply chains.
We're looking for a Staff Software Engineer to help lead our Data Identity team - the upstream data platform that every downstream data-oriented product at Sonatype depends on. If you love solving hard identity and data-modeling problems, thinking at architectural scale, and shaping the direction of a small, high-leverage team, we'd love to hear from you.
About Data Identity
Data Identity is Sonatype's upstream data platform - the feeder team for every downstream data-oriented team and product at Sonatype. Vulnerability intelligence, policy, developer tooling, malware detection, and the rest all start from the identity data we produce: what a package is, what its coordinates mean, which versions exist, how it maps across ecosystems (Maven, npm, PyPI, Go, and beyond), and how it should be joined to security, license, and quality signals.
We operate at supply-chain scale: billions of package observations, streaming ingestion, batch processing, and a growing catalog of commercial-vendor SBOM feeds that must be resolved against the open-source universe. Data warehouse structural desin - every other data-oriented team feels within a release cycle.
What you'll do:
As a Staff Software Engineer on Data Identity, you'll set technical direction for the team's next generation. You'll be the senior technical voice on the team, partnering with the team lead and product on multi-quarter architectural bets, and the person other Staff engineers reach for when questions about package identity, coordinate modeling, or upstream data contracts land on their desk.
This is a high-leverage seat. Data Identity is small - about five engineers - but the blast radius of our decisions is wide.
Key Responsibilities:
Own the identity data model. Coordinate schemas, cross-ecosystem mapping, name-based implications, deduplication, and re-discovery are the recurring technical themes of this team. You'll set direction on how they evolve.
Architect the streaming and batch pipelines. Our stack sits on Java, Spark/EMR, HBase, Databricks , and AWS data primitives. You'll drive migrations, cost and reliability improvements, and the underlying infrastructure choices.
Design the data contracts that downstream teams consume. Schema stability, versioning, and rollout are as much of the job as the pipeline internals - because breaking a contract means breaking a downstream product.
Lead commercial vendor ingestion. Data Identity is Sonatype's front door for third-party SBOM feeds (CycloneDX, VEX, SPDX). You'll represent us in technical conversations with vendor engineering teams, negotiate spec, and translate what they can produce into what our platform can consume.
Apply AI where it earns its place in the data. We have real work in identity re-discovery, package deduplication, and data-quality signals where AI/ML techniques should be explored further to measure how viable it may be. This is AI applied to the data itself, not AI as developer tooling.
Work with AI-assisted engineering tools every day. Claude and equivalent tools are standard equipment on this team - for coding, code review, investigation, and data exploration. You're expected to use them well and keep growing your fluency with them as the tooling evolves.
Raise the reliability floor. Alarm triage, SLO discipline, cost management (compute isn't cheap at our scale), and incident-response leadership are part of the seat.
What you bring:
We're seeking an experienced engineer who thrives in an agile, collaborative environment and enjoys tackling technical challenges at architectural scale.
10+ years of professional software engineering experience, including 3+ years at Staff level or with equivalent scope: setting technical direction for a team, owning a system end-to-end across multiple release cycles, and influencing peer teams without direct authority.
Deep experience with data-platform engineering at scale. Streaming and batch pipelines, distributed storage, and the operational realities of running them in production. Spark, HBase, Databricks, or comparable systems.
Strong Java proficiency, or a systems-programming background that will get you productive quickly.
A track record with cross-team data contracts - schema design, versioning, backward compatibility, and the coordination work that comes with sitting upstream of many teams.
AWS-native operating experience. EMR, S3, SNS & SQS, and sound cost/performance instincts on those primitives.
Comfort with ambiguity and vendor-facing work. Third-party ingestion means joining calls with external engineering teams and finding workable spec together.
Working fluency with AI-assisted engineering tools (Claude or equivalent) as part of your daily workflow, and a commitment to keep investing in those skills. This is not optional at Sonatype - the team expects it, and it's how we move at the pace we need to.
Sound judgment on when to apply AI to the problem itself. You can articulate where LLMs and classical ML each fit in a data pipeline, and - more importantly - where they don't.
Bachelor's degree in Computer Science, Engineering, or a related field, or equivalent practical experience.
Experience working in an agile environment and collaborating with cross-functional teams.
It’d be great if you also had:
Package-ecosystem depth (Maven internals, npm, PyPI, Go modules, RPM/Debian) - enough to know why coordinate schemes differ and why cross-ecosystem mapping is genuinely hard.
CycloneDX, VEX, SPDX, or other SBOM-standard experience.
Prior work on entity resolution, deduplication, or record-linkage problems.
Open-source contributions in the supply-chain, data-engineering, or package-ecosystem spaces.
Things we are proud of: