Sonatype is the software supply chain security company. We provide the world’s best end-to-end software supply chain security solution, combining the only proactive protection against malicious open source, the only enterprise grade SBOM management and the leading open source dependency management platform. This empowers enterprises to create and maintain secure, quality, and innovative software at scale.
As founders of Nexus Repository and stewards of Maven Central, the world’s largest repository of Java open-source software, we are software pioneers and our open source expertise is unmatched. We empower innovation with an unparalleled commitment to build faster, safer software and harness AI and data intelligence to mitigate risk, maximize efficiencies, and drive powerful software development.
More than 2,000 organizations, including 70% of the Fortune 100 and 15 million software developers, rely on Sonatype to optimize their software supply chains.
We're looking for a Staff Software Engineer to help lead our Data Identity team — the upstream data platform that every downstream data-oriented product at Sonatype depends on. If you love solving hard identity and data-modeling problems, thinking at architectural scale, and shaping the direction of a small, high-leverage team, we'd love to hear from you.
About Data IdentityData Identity is Sonatype's upstream data platform — the feeder team for every downstream data-oriented team and product at Sonatype. Vulnerability intelligence, policy, developer tooling, malware detection, and the rest all start from the identity data we produce: what a package is, what its coordinates mean, which versions exist, how it maps across ecosystems (Maven, npm, PyPI, Go, and beyond), and how it should be joined to security, license, and quality signals.
We operate at supply-chain scale: billions of package observations, streaming ingestion, batch processing, and a growing catalog of commercial-vendor SBOM feeds that must be resolved against the open-source universe. Data warehouse structural desin — every other data-oriented team feels within a release cycle.
What you'll do:
Own the identity data model. Coordinate schemas, cross-ecosystem mapping, name-based implications, deduplication, and re-discovery are the recurring technical themes of this team. You'll set direction on how they evolve.
Architect the streaming and batch pipelines. Our stack sits on Java, Spark/EMR, HBase, Databricks , and AWS data primitives. You'll drive migrations, cost and reliability improvements, and the underlying infrastructure choices.
Design the data contracts that downstream teams consume. Schema stability, versioning, and rollout are as much of the job as the pipeline internals — because breaking a contract means breaking a downstream product.
Lead commercial vendor ingestion. Data Identity is Sonatype's front door for third-party SBOM feeds (CycloneDX, VEX, SPDX). You'll represent us in technical conversations with vendor engineering teams, negotiate spec, and translate what they can produce into what our platform can consume.
Apply AI where it earns its place in the data. We have real work in identity re-discovery, package deduplication, and data-quality signals where AI/ML techniques should be explored further to measure how viable it may be. This is AI applied to the data itself, not AI as developer tooling.
Work with AI-assisted engineering tools every day. Claude and equivalent tools are standard equipment on this team — for coding, code review, investigation, and data exploration. You're expected to use them well and keep growing your fluency with them as the tooling evolves.
Raise the reliability floor. Alarm triage, SLO discipline, cost management (compute isn't cheap at our scale), and incident-response leadership are part of the seat.
As a Staff Software Engineer on Data Identity, you'll set technical direction for the team's next generation. You'll be the senior technical voice on the team, partnering with the team lead and product on multi-quarter architectural bets, and the person other Staff engineers reach for when questions about package identity, coordinate modeling, or upstream data contracts land on their desk.
This is a high-leverage seat. Data Identity is small — about five engineers — but the blast radius of our decisions is wide.
Key Responsibilities:What you bring:
10+ years of professional software engineering experience, including 3+ years at Staff level or with equivalent scope: setting technical direction for a team, owning a system end-to-end across multiple release cycles, and influencing peer teams without direct authority.
Deep experience with data-platform engineering at scale. Streaming and batch pipelines, distributed storage, and the operational realities of running them in production. Spark, HBase, Databricks, or comparable systems.
Strong Java proficiency, or a systems-programming background that will get you productive quickly.
A track record with cross-team data contracts — schema design, versioning, backward compatibility, and the coordination work that comes with sitting upstream of many teams.
AWS-native operating experience. EMR, S3, SNS & SQS, and sound cost/performance instincts on those primitives.
Comfort with ambiguity and vendor-facing work. Third-party ingestion means joining calls with external engineering teams and finding workable spec together.
Working fluency with AI-assisted engineering tools (Claude or equivalent) as part of your daily workflow, and a commitment to keep investing in those skills. This is not optional at Sonatype — the team expects it, and it's how we move at the pace we need to.
Sound judgment on when to apply AI to the problem itself. You can articulate where LLMs and classical ML each fit in a data pipeline, and — more importantly — where they don't.
Bachelor's degree in Computer Science, Engineering, or a related field, or equivalent practical experience.
Experience working in an agile environment and collaborating with cross-functional teams.
We're seeking an experienced engineer who thrives in an agile, collaborative environment and enjoys tackling technical challenges at architectural scale.
It’d be great if you also had:
Package-ecosystem depth (Maven internals, npm, PyPI, Go modules, RPM/Debian) — enough to know why coordinate schemes differ and why cross-ecosystem mapping is genuinely hard.
CycloneDX, VEX, SPDX, or other SBOM-standard experience.
Prior work on entity resolution, deduplication, or record-linkage problems.
Open-source contributions in the supply-chain, data-engineering, or package-ecosystem spaces.
Things we are proud of:
- 2026 Gartner® Magic Quadrant™ Leader for Software Supply Chain Security
- 2026 Celebrating 15 Years of Sonatype Research Labs – Industry-leading software supply chain and open source security research
- 2026 Founding Member of the Linux Foundation Initiative for Open Source Sustainability
- 2026 State of the Software Supply Chain® Report – Continuing industry leadership in software supply chain security and AI security research
- 2025 Visionary in Gartner® Magic Quadrant™ for Application Security Testing!
- 2025 AI Compliance Solution of the Year - AI Breakthrough Awards
- 2025 DEVIES Award to our SBOM Manager for a new product for its innovation and impact in developer technology
- 2024 Industry Leader in Forrester-Wave for Software Composition Analysis (2024 Q4 report)
- Constellation AST Shortlist: Sonatype has been listed on the Constellation ShortList™ for Application Security Testing for 2024
- Data Breakthrough Awards: Sonatype was announced as a 2024 winner in the "Open Source Data Solution of the Year."
- SD Times: Best in Show Security
- Fast Company Best Workplaces for Innovators 2024
- The Herd Top 100 Private Software Companies 2024
- Diversity & Inclusion Working Groups
- Parental Leave Policy
- Paid Volunteer Time Off (VTO)
Skills Required
- 10+ years of professional software engineering experience, including 3+ years at Staff level or equivalent scope
- Deep experience with data-platform engineering at scale (streaming and batch pipelines, distributed storage, operational production experience)
- Experience with Spark, HBase, Databricks, or comparable systems
- Strong Java proficiency or systems-programming background
- Track record designing and managing cross-team data contracts, schema design, and versioning
- AWS-native operating experience (EMR, S3, SNS, SQS) with cost/performance instincts
- Working fluency with AI-assisted engineering tools (Claude or equivalent) and judgment about applying AI/ML
- Bachelor's degree in Computer Science, Engineering, or related field, or equivalent practical experience
- Experience working in an agile environment and collaborating with cross-functional teams
- Comfort with vendor-facing work and ambiguity (joining technical calls, spec negotiation)
- Package-ecosystem depth (Maven internals, npm, PyPI, Go modules, RPM/Debian)
- Experience with CycloneDX, VEX, SPDX or other SBOM standards
- Prior work on entity resolution, deduplication, or record-linkage problems
- Open-source contributions in supply-chain, data-engineering, or package-ecosystem spaces
What We Do
The Sonatype journey started almost 15 years ago, just as the concept of “open source” software development was gaining steam. From our humble beginning as core contributors to Apache Maven, to supporting the world’s largest repository of open source components (Central), to distributing the world's most popular repository manager (Nexus), we’ve played a meaningful role in helping the world embrace the power of open innovation. We empower developers and security professionals with intelligent tools to innovate more securely at scale. Our platform addresses every element of an organization’s entire software development life cycle, including third-party open source code, first-party source code, and containerized code. Sonatype identifies critical security vulnerabilities and code quality issues and reports results directly to developers when they can most effectively fix them. This helps organizations develop consistently high-quality, secure software which fully meets their business needs and those of their end-customers and partners. More than 2,000 organizations, including 70% of the Fortune 100, and 15 million software developers rely on our tools and guidance to help them deliver and maintain exceptional and secure software.
Why Work With Us
We're on a mission to change how the world innovates by making software development easier. Already used by 15 million developers, we have lofty goals for our technology to be in the hands of every engineering team. And, we need you to do that. Join us!
Gallery
.png)
.png)
