Staff / Senior Software Engineer, Security Fusion Platform

About the role

Data Center Security Engineering (DCSE) owns physical security across Anthropic's data center footprint: the sites, the hardware inside them, and the supply chain that delivers it. The Security Fusion Platform is where physical security signals from across that footprint are correlated and put in front of the analysts who act on them. It carries continuous monitoring, audit evidence, metrics, and analyst response, along with the classification and analytics pipelines that turn sensor data into events. You'll build and own the platform analysts work from.

This is a foundational role. You'll build the software platform that carries a signal from source to analyst decision, ship its first versions, and keep them running in production. The sensors and systems at each site belong to other DCSE engineers; you define the event contract their owners deliver to, and you build the classification and analytics pipelines that run over what those sources produce. Physical security systems engineers own the operations spaces; you own the software that runs in them. You'll work alongside engineers focused on the sites themselves. What you lead, you own end to end: the design, the technical approach, and the result in production.

You'll work with external vendors and integrators, setting requirements and acceptance criteria for what you own and deciding what the team builds itself. We use Claude throughout our engineering workflow and expect you to as well.

This role involves regular travel to data center sites. No security clearance is required. These are critical services, and you'll take part in on-call for them.

Key responsibilities

• Design and build the event bus and normalized event schema: source identity, sequencing, health state, and the adapter contract that owners of each sensor and system feed build to, plus adapters where needed

• Build correlation and alerting: the rules and services that turn events from independent sources into alerts an analyst can act on

• Build the classification and analytics pipelines: computer vision and multi-sensor fusion, with results landing on the event bus

• Build analyst surfaces: the queue, escalation tooling, dashboards, camera viewers, and video wall content a 24/7 watch works from, plus video analytics integration so camera streams arrive on the bus as events

• Deliver audit evidence: durable, tamper-evident event history, evidence exports, and the retention and access controls around them

• Instrument metrics and self-monitoring: detection rates, nuisance ratios, alert aging, time to resolve; heartbeats and loss-of-telemetry alarms on every feed, tested fail-secure behavior, and change audit on every rule

• Deploy across sites: site-local components, central services, and the sync that keeps configuration, rules, and state consistent, then commission each site and hand over to the analysts

• Specify the compute the platform runs on (servers, storage, and the platform's network segment) to the team's segmentation and hardening baseline

• Write requirements and acceptance criteria for what vendors and integrators deliver, review deliverables against them, and make the call on accepting or rejecting the work

Minimum qualifications

• Have built and run event-driven backend systems in production

• Are proficient in at least one backend language such as Python, Go, or Rust, and have worked with a message bus or event streaming system such as Kafka

• Have owned a system end to end: set the design, made the tradeoffs, shipped it, and answered for it in production

• Have integrated with external systems you did not control (vendor APIs, on-prem appliances, video platforms, building systems) and designed for a life beyond any one vendor

• Have directed vendor or integrator work: written requirements and acceptance criteria, reviewed deliverables against them, and decided what gets accepted

• Design for the failure you won't see coming (a silent feed, a lost network path, a replayed event, a de-tuned rule), know how your system behaves when a source lies or goes quiet, and test for it

• Build tools for people who use them under pressure and iterate with those operators

Preferred qualifications

• Experience building or operating a security operations platform (SOC, physical security operations, or the detection engineering behind one)

• Experience building ML or computer vision inference pipelines over video and sensor streams

• PSIM (physical security information management) or VMS (video management system) integration experience, or familiarity with physical access control and building systems data

• Experience producing evidence for auditors or assessors: log integrity, retention, chain of custody

• Experience using AI-assisted development tooling as a core part of your workflow