Agentic Security Platform at Databricks
Autonomous agents pose serious containment challenges. They run arbitrary code, touch sensitive databases, and make external HTTP calls. Traditional Docker boundaries are too porous and sluggish for high-speed agentic execution loops. Databricks builds hardened agent isolation engines in Rust combining Wasmtime sandboxes with lightweight Firecracker microVMs. Zero trust by design. Guest workloads run with restricted capabilities governed by Landlock LSM policies and strict seccomp filters. Custom Rust proxies inspect all outbound network sockets, validating mTLS certificates via Rustls and enforcing fine-grained egress policies before bytes leave the host. The architecture isolates tenant secrets while maintaining sub-millisecond invocation times for distributed evaluation pipelines.
Disclosed base salary for California is $228,000 to $314,000 USD plus annual equity awards.
Core Production Responsibilities
- Design and implement low-overhead execution sandboxes using WebAssembly (Wasmtime) and microVMs.
- Build kernel-level containment layers using eBPF, Landlock, and seccomp-bpf in Rust.
- Develop cryptographic identity attestation and policy verification for AI agent tool invocations.
- Collaborate with security research teams to model threat vectors around prompt injection and data exfiltration.
Technical Background
- Extensive experience implementing security boundaries, hypervisors, or sandboxes in Rust or C++.
- Deep understanding of Linux security primitives (cgroups, namespaces, Landlock, seccomp).
- Working knowledge of WebAssembly component models or microVM hypervisor architectures.
- Disclosed base salary: $228,000 to $314,000 USD plus equity.
