Principal Software Engineer, Agent Policy Fabric

## Principal Software Engineer, Agent Policy Fabric Apply locations:
US, CA, Santa Clara:
US, NC, Remote:
US, TX, Remote:
US, NY, Remote:
US, FL, Remote time type:
Full time posted on:
Posted Yesterday job requisition :
JR2019848

NVIDIA is widely recognized as one of the most desirable employers, with some of the world's most dedicated people working for us! The Cloud Engineering & Services team is building an enterprise governance layer for agentic systems: signed policy, runtime verification, policy projection, credential mediation, detector verdict handling, and common audit across runtime substrates and enterprise integrations.

We are looking for a Principal Software Engineer, Agent Policy Fabric (APF) Core Platform, to join our Cloud Engineering & Services team and mature the scoped APF v0 proof-of-life into a robust core platform for governed agent action. You will play a critical role in building the foundations for the signed policy, Runtime Policy Verifier, projection, conformance, and failure mode that future APF deployments depend on.
** What You'll Be Doing:
*** Own APF Core Services:
Build and harden the Runtime Policy Verifier, signed policy bundle verification, trust-root handling, freshness, rollback protection, subject binding to attested runtime context, revocation checks, and authorization APIs used by APF-compatible enforcement points.
* Design Policy Projection:
Implement deterministic projections from the canonical APF policy into Open Shell-native runtime policy, adapter constraints, credential constraints, audit requirements, and model-visible tool hints, while preserving the atomic projection-admission contract.
* Build Conformance and Verification:
Create golden fixtures, compatibility tests, negative tests, fuzz/property tests, and conformance suites that prove APF-compatible runtimes and adapters honor the same contract.
* Collaborate with Runtime Owners:
Engage alongside Open Shell and Infrastructure engineers on public runtime interfaces for projection consumption, runtime context attestation, approved adapter paths, direct egress verification, and admission/rejection semantics.
* Land the Runtime integration surfaces. Own the cross-team work with Open Shell and other runtime owners to land public substrate interfaces APF composes against — runtime-context attestation, approved adapter path declaration, projection acceptance and rejection semantics, quarantine, and stop-session hooks. Land each as a public RFC or PR.
* Drive Architecture Maturity:
Define versioning, schema compatibility, latency budgets, availability behavior, fail-closed defaults, last-known-good policy handling, and engineering review artifacts for Product Security, Fleet, Identity, and partner teams.
* Evolve technical specifications. Write specifications, defend bounded claims in security and architecture reviews, drive open-decision resolution, and turn working-draft contracts into engineering artifacts that Product Security, Fleet, Identity, and partner runtimes can adopt.
** What We Need To See:
*** Bachelor's degree (or equivalent experience) with 15+ years of industry experience in systems software, security engineering, distributed systems, or policy infrastructure.
* Technical Core:
Strong programming skills in Rust, Go, C++, or Python; experience designing production services, APIs, schemas, policy engines, authorization systems, or signed artifact pipelines.
* Infrastructure Familiarity:
Linux systems, IPC or service-to-service APIs, protobuf/gRPC or equivalent wire formats, CI, test automation, release engineering, and cloud or enterprise deployment environments.
* Security Engineering:
Practical experience with authorization, cryptographic signatures, trust roots, revocation, subject binding,…