Staff Software Engineer - Agentic First

Sonatype is the software supply chain security company. As an agentic-first Staff Software Engineer, you will lead the design and delivery of enterprise-grade capabilities within Nexus Repository Manager, setting technical direction and mentoring other engineers to secure software supply chains at scale.

Responsibilities:

• Drive the technical design of major agentic-first subsystems — service architecture, data models, and agent/tool integrations — by running long-running, multi-agent workflows across decomposition, orchestration, implementation, testing, and review
• Take major initiatives from ambiguous problem statements through technical design, multi-team execution, rollout, and long-term operability
• Spend your time on direction, review, and taste rather than line-by-line coding. Define the evals, harnesses, guardrails, and review rituals that let your team confidently ship code no human typed
• Set the bar for how Sonatype engineers work with agents. Shape internal playbooks, tooling, and rituals; train Senior engineers in the craft; and raise the ceiling on what's possible
• Own non-functional requirements for your area — performance, reliability, and security — with particular attention to software supply chain threats (malicious packages, dependency confusion, provenance, SBOM accuracy)
• Partner with Product, Security Research, UX, and Support leaders to translate ambiguous customer needs into concrete, shippable technical plans; conduct deep design reviews; and raise the quality bar through thoughtful mentorship

Requirements:

• 7+ years of professional software development experience
• Strong experience with Java
• Experience with Cloud (AWS / Azure / GCP)
• Experience with large-scale distributed systems
• Experience with performance tuning
• Experience with data-intensive services
• Experience with production operability at scale
• Working knowledge of software supply chain security
• Familiarity with SBOM formats (CycloneDX, SPDX)
• Knowledge of SCA, SLSA provenance, Sigstore/cosign signing
• Knowledge of vulnerability analysis (OSV, NVD)
• Understanding of common attack patterns against package ecosystems
• Hands-on experience designing, running, and scaling multi-agent systems
• Experience with MCP tooling, shared context and memory, agent handoffs, and robust eval harnesses
• Ability to define evals, test harnesses, observability, and review workflows
• Ability to make product decisions independently
• Ability to drive scope, trade-offs, and sequencing without constant PM hand-holding
• Ability to lead internal rollouts and push the state of the art on how engineers work alongside agents
• Ability to architect and lead the technical design of major agentic-first subsystems
• Ability to partner with Product, Security Research, UX, and Support leaders
• Ability to own non-functional requirements for performance, reliability, and security
• Experience with multi-agent orchestration
• Experience with long-running, multi-agent workflows
• Experience with defining internal playbooks, tooling, and rituals
• Experience with mentoring Senior engineers