Autonomy Software Engineer

Requirements

• 8+ years building production software for robotics, aerospace, AV, or other safety-critical embedded systems
• Expert in Rust and/or C++ (C as a plus) for real-time, fault-tolerant applications on embedded Linux/RTOS
• Demonstrated systems thinking: clear interface design, resource budgeting, and trade-offs under timing/safety/power constraints
• Hands‑on with SIL/HIL, scenario validation, log replay, and fault injection; you measure reliability, not just functionality
• Track record of shipping autonomy features (mission logic, supervision, watchdogs, health monitoring) into noisy, dynamic real‑world environments
• Comfort in HW/SW co‑design: you can reason about sensors, compute, comms, and actuators well enough to make robust software decisions
• Strong communication and documentation; you make complex safety decisions legible and auditable

• Own the flight‑critical runtime that keeps Zipline aircraft in a known safe state—no matter what the world throws at them
• You’ll architect and ship the autonomy safety layer that orchestrates missions, detects/diagnoses faults, and executes mitigation and recovery across planning, perception, and controls
• This is deep systems work in Rust/C++ with tight real‑time constraints: you’ll make high‑judgment design decisions, prove them in SIL/HIL and flight logs, and raise the bar on reliability for a global, safety‑critical fleet
• Design the mission/flight manager: build the state machines and orchestration logic that govern mission sequencing, safe‑state transitions, and behavior gating under latency and resource constraints
• Own fault management end‑to‑end: implement detection, isolation, mitigation, and recovery (FIMR) for sensors, compute, comms, power, and actuation; ensure graceful degradation and continuity of service
• Ship flight‑critical Rust/C++: develop and maintain core onboard components with strong observability (health, logs, metrics) and testability (deterministic replay, assertions, in variants)
• Prove safety before flight: define success criteria and build the tooling—scenario libraries, SIL/HIL, log‑replay harnesses, fault‑injection—to validate behaviors across edge cases and long‑tail conditions
• Integrate across autonomy: partner with planning, perception, and controls to set interfaces, hazards/assumptions, and escalation paths; codify contracts that the runtime enforces
• Close the loop with operations: turn fleet telemetry and incident reviews into requirements and fixes; drive MTBF/MTTR improvements and intervention‑rate reductions
• Lead with systems judgment: write design docs, perform hazard analysis (e.g., FMEA/STPA‑style), run design/PR reviews, and mentor engineers on deep‑stack ownership