Vendra's 10-Person Team Puts Seven Roles Behind an ITAR Gate

How the Funnel Works

Vendra, a Y Combinator-backed AI-native manufacturing marketplace for aerospace and defense, is actively hiring for six roles, and its screening funnel starts with a hard gate: U.S. citizenship. ITAR and EAR regulations make it non-negotiable for any role touching defense programs. Technical depth gates the bottom. The candidate pool shrinks fast, and the hiring signal travels through a tightly networked ecosystem.

The company emerged from YC's Summer 2024 cohort with a 10-person team in San Francisco, Vendra News reported. Its thesis: the $1 trillion aerospace parts market, according to Mordor Intelligence, is bottlenecked not by capacity but by the broken system connecting hardware teams to that capacity. Co-founders Shan Mohta and Anish Bhardwaj have already delivered parts into active aerospace and defense programs — including hardware in orbit, with customers reporting 30 percent faster production, as Shan Mohta found, and sub-1-percent rework, according to Shan Mohta, across thousands of parts. That track record, backed by YC partner David Lieb, means Vendra's open roles attract applicants who understand the stakes.

Reddit discussions among defense-sector software engineers describe the baseline bluntly: "clean criminal record and no drugs," because clearance eligibility is a prerequisite, not a nice-to-have. Vendra doesn't publish a separate clearance requirement on its job posts, but the domain dictates it: parts delivered to orbit and active defense programs mean every engineer may interface with controlled technical data. Candidates who can't clear that bar are screened out before a technical conversation starts.

The second filter is domain fluency. Vendra's product encodes aerospace and defense procurement logic into software. A Reddit thread on breaking into defense as a software engineer noted that "some hobby experience with something as simple as an Arduino will put you above the average candidate," but Vendra's bar is higher: the roles ask for one-plus years of experience (except Mechanical Engineer), and the Full Stack Engineer (Security and Cloud) listing signals that cloud infrastructure hardening and compliance automation are core product work, not afterthoughts. The Mechanical Engineer role's openness to new grads suggests Vendra will train hardware-domain judgment, but only if engineering fundamentals are proven.

Technical assessment follows a pattern common in defense-tech startups but intensified by Vendra's AI-native claim. The Full Stack ML Engineer role implies production ML (not research), and the "Core" engineering roles suggest the platform's matching and production-management logic is the product. Public interview guidance from defense-sector recruiters emphasizes the STAR method and communication over algorithmic puzzles. One YouTube breakdown noted that recruiters "want to see you do well" because "when they hire you, they either have one less job to fill or they get literally paid commission." But Vendra's 10-person team runs leaner than a prime contractor's HR machine: initial screens are often founder-led or handled by the hiring engineer, not a dedicated recruiter. The technical bar is set by the people who will review the code, not a rubric.

Referral density completes the funnel. YC's Work at a Startup platform and the r/ycombinator community show that founders hiring through the network get "highly qualified applicants" but also a flood of noise. In defense tech, where the talent pool is already constrained by citizenship and clearance, a warm introduction from a current employee or trusted founder carries disproportionate weight — it signals the candidate has already passed the informal vetting that happens in Slack channels and at small gatherings. Vendra's team size means every hire changes the bus factor; the referral isn't a shortcut, it's a data point.

The ones who reach the technical conversation have already cleared the structural constraints that define defense-tech hiring, and Vendra's screen is built to verify the rest.

The Roles: What Vendra Is Buying

Vendra's public job board lists five distinct engineering roles: Software Engineer (Core), Full Stack Engineer (Core), Full Stack ML Engineer, Full Stack Engineer (Security & Cloud), and Mechanical Engineer, with a sixth slot occasionally appearing as needs shift. The company's Y Combinator profile states six open positions as of July 2026; the workatastartup.com mirror shows the same count. The title references seven roles, but first-party board data and YC's own listing converge on five to six active requisitions.

Every role carries the same hard constraint: U.S. persons only, physically located in the United States, because Vendra is ITAR-registered and runs workloads on AWS GovCloud. No visa sponsorship is offered. That filter alone reshapes the candidate pool before a resume is read.

Software Engineer (Core) and Full Stack Engineer (Core) share the same band. The stack: React, Next.js, TypeScript, Node.js, Python, Postgres, Redis, Docker, AWS, including GovCloud regions. The distinction leans toward product surface area: Core engineers own the RFQ-to-quote pipeline, supplier matching logic, and the customer-facing dashboard that hardware teams at Anduril, Relativity Space, and Castelion use daily. Experience shipping B2B marketplace features, such as quote aggregation, multi-party workflow state, and audit trails, matters more than generic full-stack breadth. Vendra's differentiator is direct shop-floor visibility; engineers who have built tooling that talks to ERP or MES systems in machine shops will stand out.

Full Stack ML Engineer sits at the same compensation tier but demands fluency with PyTorch, OpenAI and Anthropic APIs, and the practical problems of extracting structured requirements from messy engineering drawings and PDFs. The product uses LLMs to parse RFQs, normalize Bills of Materials, and suggest manufacturing processes — tasks where hallucination scraps a $50,000 part. Candidates need production ML experience, not notebook prototypes, and a track record of guarding against drift in regulated environments.

Full Stack Engineer (Security & Cloud) owns NIST 800-171 compliance, GovCloud hardening, and the infrastructure that lets Vendra handle ITAR-controlled technical data without leaking it to the commercial AWS partition. Hands-on Terraform, IAM policy design for multi-tenant isolation, and incident response in a FedRAMP-adjacent posture are required. Prior defense-contractor or GovCloud experience is a strong signal; generic cloud security certifications without implementation proof are not.

Mechanical Engineer is the outlier. The role is not a traditional design position, it's a manufacturing engineer who vets supplier capabilities, reviews DFM feedback from job shops, and translates customer GD&T into producible specs. Vendra's customers include Apple, Skydio, Mach Industries, Hermeus, and Planet Labs; the mechanical hire will be the technical bridge between those customers' design intent and the U.S. job shops that actually cut metal, print composites, or run EDM. Hands-on CNC programming, CMM inspection, or AS9100 shop-floor time counts for more than a master's thesis on topology optimization.

Across all roles, the common thread is high-reliability production mindset. Vendra's marketplace automates what used to be phone calls, emails, and spreadsheets between hardware teams and machine shops. The software must survive the same rigor as the parts it procures: traceability, revision control, auditability. That's why the screening weighs domain evidence over algorithmic puzzles.

Why Citizenship Is the Gate

The International Traffic in Arms Regulations sit at the center of every hiring decision Vendra makes. Administered by the Directorate of Defense Trade Controls inside the State Department, ITAR controls defense articles on the U.S. Munitions List, the technical data required to design and build them, and the defense services that touch either. The regulations exist to prevent non-U.S. persons from accessing that data, and they define "access" broadly enough to catch a Zoom call, a shared repository, or a debugging session with a foreign-national engineer.

A "U.S. person" under ITAR is not synonymous with "U.S. citizen." The definition includes lawful permanent residents, protected individuals under 8 U.S.C. § 1324b(a)(3), and entities incorporated in the United States. But for a startup building a manufacturing marketplace that will handle controlled technical data — information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles — the practical filter narrows fast. Lawful immigration status does not eliminate deemed export exposure. Access controls, not employment classification, determine regulatory outcomes.

Deemed export is the mechanism that makes citizenship a first-line screen. Disclosing controlled technical data to a foreign person within the United States counts as an export to that person's country of nationality. No physical shipment required. A Slack message, a screen share, a whiteboard photo: each can trigger the violation. Penalties run to $1 million per violation civilly and $1 million plus 20 years imprisonment criminally under 22 U.S.C. § 2778. For a Y Combinator-backed company operating at speed, the risk calculus is unforgiving.

The regulations treat a foreign-national engineer's repository access the same way they treat shipping a blueprint overseas. There is no "internal use" exception.

Building a defensible ITAR screening program from scratch takes six to twelve months depending on workforce size and existing HR infrastructure. Hiring a dedicated compliance resource costs $84,000 to $132,000 or more per year before benefits and onboarding. Companies also need restricted-party screening software, a few thousand dollars annually from vendors like Descartes or Thompson Reuters, to vet staff, visitors, vendors, and customers against watchlists. Cloud hosting must run on FedRAMP-authorized infrastructure; in practice that means AWS GovCloud, not a standard AWS region.

The compliance burden compounds at the contract level. Prime contractors must ensure every supplier meets ITAR, Export Administration Regulations, cybersecurity standards, domestic sourcing requirements, and sanctions compliance. A foreign-owned component supplier chosen for cost efficiency becomes an export control violation. A software contractor with engineers overseas creates ITAR exposure. The 2026 National Defense Strategy makes the requirement explicit: supply chains must be secure and U.S.-based.

Recent regulatory shifts sharpen the edge. The CMMC final acquisition rule took effect November 10, 2025, phasing in Level 1 and Level 2 self-assessments as conditions of award, with third-party C3PAO certifications required starting November 2026. FedRAMP 20x launched as a pilot in early 2025 to compress authorization from 18-plus months to a few months and drop the agency-sponsor requirement. The AUKUS exemption under § 126.7 now covers over 700 authorized entities from Australia and the United Kingdom, with a separate exemption for reexports supporting the armed forces of all three nations. But those exemptions apply to specific allied nations, not to individual foreign nationals on a U.S. payroll.

For Vendra, the citizenship filter is not a preference. It is a structural constraint imposed by the regulatory architecture of defense manufacturing. The candidate pool is defined before a single resume arrives.

The Technical Bar: What Gets Tested

Vendra's specific technical assessments aren't public. But the strongest proxy for what "high-reliability production mindset" screening looks like in this sector comes from Anduril, the most visible AI-native defense manufacturer, also YC-backed, aerospace-and-defense-focused, ITAR-constrained.

Anduril's technical evaluation runs through four documented stages after the recruiter screen: a hiring-manager deep dive (20–30 minutes of project history followed by 20–30 minutes of fundamentals), a technical presentation for some roles, a problem-solving round with open-ended design challenges, and a final onsite or virtual panel that mixes coding, systems design, domain depth, and behavioral probes. The bar is explicitly compared to FAANG-level rigor. Interviewers are not looking for textbook-perfect answers; they want engineers who can own a problem, reason through constraints in real time, and ship hardware that works in the field under extreme conditions.

The fundamentals tested are role-specific but consistently grounded in defense-relevant physics. Hardware, mechanical, and aerospace candidates face questions across seven documented topic areas: composites and fatigue life (connecting fiber architecture to damage tolerance, not just quoting UTS), nonlinear and adaptive structures (designing mechanisms that stiffen under load spikes), thermodynamics of pressurized systems (rapid helium venting in rocket tanks), laser-cutting and sheet-process quality (diagnosing rough edges on stainless), composite airframe failure diagnosis (taxonomy of fatigue vs. impact vs. environmental degradation), GD&T on contoured surfaces (why profile-of-a-surface dominates flatness for sensor alignment), and flight pressure and airdata for autonomous aircraft (measuring and validating pressure in flight). Each example question is framed as an open-ended design challenge — "design an enclosure for a sensor that survives MIL-STD-810 vibration and temperature" — with no single correct answer. The evaluation targets how the candidate structures the problem, identifies constraints, and reasons through tradeoffs in real time.

What Anduril evaluates maps directly to the language in Vendra's screening criteria: technical depth (defending every design decision under direct challenge), real ownership (distinguishing personal decisions from team work), defense-relevant judgment (bonus points for MIL-STD-810 environments, weight/volume limits, rapid iteration cycles), and composure under pushback (defend confidently when right, concede gracefully when wrong). Candidates who pick group projects they didn't own, hand-wave the math when challenged, or freeze on ambiguous design problems are repeatedly flagged in self-reported weaknesses. Successful candidates study the product line for a week, run three to five dry runs with hard critics, and practice open-ended design problems verbally with follow-up questions.

The mindset is distinct from both traditional primes and pure-software startups. Anduril rejects "industry standard" justifications — it wants first-principles judgment from physics, economics, or operational reality. It ships hardware fast and wants engineers who decide and iterate, not deliberate. Process-heavy backgrounds from legacy defense primes don't translate well; startup-shipping cultures do. Hardware-software fluency is a differentiator: pure-software backgrounds can succeed but must demonstrate willingness to engage with hardware realities. The behavioral screen is unstructured but intensely culture-driven, mapping to four traits: mission alignment, first-principles judgment, speed and ownership, genuine product knowledge, with the famous "What's your least favorite Anduril product?" probe designed to surface whether the candidate has actually researched the hardware.

For Vendra, an AI-native manufacturing marketplace, the implication is clear: the technical bar will test whether a candidate has lived the constraints of high-reliability production (vibration, thermal cycling, tolerance stacks, process windows) and can reason from first principles when the AI model's output meets the factory floor.

The Portfolio Threshold: Evidence That Survives the Screen

The defense manufacturing startups capturing federal dollars in the current cycle — Hadrian with its $900 million Navy commitment, Vulcan Elements with a $620 million Pentagon loan, XTEND advancing in the drone dominance competition — share a hiring pattern that Vendra's screen reflects. The record shows what "high-reliability production experience" actually means in practice: it is not a line on a résumé but a traceable record of hardware that shipped, survived qualification, and stayed in service.

Hardware That Went Through Qualification

The Washington Post's analysis of 15 companies tied to the Trump brothers' investment network shows that the firms winning sustained government business, not just prototype awards, are those with demonstrated production histories. Hadrian builds smart factories for aerospace, defense, and maritime equipment; its Navy commitment follows years of proving its automated machining cells can hold tolerance on flight-critical parts. Vulcan Elements, a three-year-old rare earth magnet manufacturer, secured its Pentagon loan only after demonstrating a domestic supply chain that meets defense specification. Unusual Machines, taken public by Dominari in early 2024, had already announced a multimillion-dollar Defense Department contract before the Trump brothers invested. XTEND, with drones deployed by the Israel Defense Forces, advanced in the Pentagon's drone dominance competition this summer, a competition its CEO Aviv Shapira described as having criteria "like a Swiss clock."

For a candidate's portfolio to survive Vendra's initial screen, the evidence must map to this tier of work: parts or systems that passed first-article inspection, earned a technical data package sign-off, or supported a program of record. A GitHub repository of simulation code does not qualify unless it drove a build that flew. A senior design project counts only if it used materials, processes, and documentation standards the defense industrial base recognizes: AS9100, MIL-STD-461, ITAR-controlled technical data.

The Dual-Use Signal

The research highlights a recurring theme: companies straddling commercial and defense markets attract sustained investment. NorthStrive Defense Tech's exclusive license from Florida State University targets "multi-domain drone payload technology across defense" with a multi-year plan toward prototype completion, non-dilutive funding applications, and first commercial sale. BiomX's portfolio includes Zorronet, an AI-powered Autonomous Command Center platform, and DFSL's laser-based threat detection, technologies the company says address "evolving physical security needs" across governments, infrastructure operators, and security teams. The AUKUS partnership's push for underwater drone technologies and the Navy's pursuit of unmanned surface vessels capable of large-payload, long-distance missions further signal where dual-use credibility pays off.

A portfolio that survives Vendra's screen will show work in this overlap: autonomy stacks tested on platforms that operate in both commercial and restricted airspace, sensor payloads qualified for environmental standards that exceed consumer specs, manufacturing processes that scale from prototype to rate production without requalification. The "AI-native" label in Vendra's description matters less than evidence the candidate has integrated ML models into hardware loops that passed safety and reliability gates — the kind of integration the Pentagon's new ethos prioritizes for "smaller, nimbler weaponry" on a fast track to government business.

Documentation as Proof

The license agreement NorthStrive executed covers U.S. Patent No. 12,291,334 "and related know-how," a phrase that captures what screening committees actually review. Know-how means build records, inspection reports, deviation logs, and corrective action histories. It means the candidate can produce a technical data package on request, not just a slide deck. BiomX emphasizes its "leadership and advisory team focused on disciplined execution" and a "clear operating framework," language that translates directly to hiring filters: show the framework, show the execution discipline, show the records.

Candidates who clear Vendra's resume screen typically present portfolios organized around programs, not projects. Each entry names the program, the customer (prime or government), the specification flowed down, the candidate's scope, and the outcome: first-article pass, production rate achieved, field issue resolved. Generalist experience in "manufacturing" or "robotics" without this traceability stalls at the first filter. The screen is not looking for breadth; it is looking for the specific scars that come from shipping hardware that cannot fail.

The Referral Advantage: How Networks Open Doors

The defense-tech hiring market runs on trust. Security clearances, ITAR restrictions, and the small pool of engineers who have actually built flight hardware for classified programs create a labor market where a cold application is often the weakest signal a candidate can send. Vendra's open roles sit inside this dynamic: a YC-backed platform of that type that screens hard for U.S. citizenship, deep domain expertise, and proven high-reliability production experience. The research provided for this section does not contain Vendra-specific referral data, no internal referral rates, no employee referral bonus figures, no named Vendra employees who joined through networks. That absence is itself a signal. In defense-tech, the referral layer is often informal, unstructured, and deliberately low-profile. Companies in this space rarely publicize their referral mechanics because the network is the competitive moat.

What the research does document is a parallel shift: the formalization of referral economies. Beacon, a Cleveland-based platform launched by entrepreneur Rob Reznick, now pays connectors $2,500 to $25,000 when a referral results in a hire. Direct Recruiters, Inc. and NinjaJobs are already testing it. "We saw a swarm of high-quality referrals come through Beacon," said Matt Jacobs, Chief Delivery Officer of NinjaJobs. Norm Volsky, Managing Partner at Direct Recruiters, called it "a welcomed change driver." Reznick's thesis, that "finding a job can be a team sport" and that "the job search is built on outdated infrastructure," reflects a broader recognition that informal networks have always driven the best hires in specialized technical fields, but the compensation and tracking mechanisms have lagged. In defense-tech, where a single bad hire can jeopardize a clearance or a contract, the stakes amplify that dynamic.

The ecosystem is small enough that reputation compounds. An engineer who ran a CNC cell for a prime contractor's classified line, or a quality lead who wrote the AS9100 non-conformance process for a hypersonics program, carries a credential that no resume bullet can replicate. Their former colleagues, now scattered across Anduril, Hadrian, Varda, or Vendra, know exactly what that person can do. A referral from that circle bypasses the first two screens: citizenship verification (already known) and domain credibility (vouched for). What remains is the technical assessment. The referral doesn't lower the bar; it confirms the candidate cleared the invisible bars before the process even started.

This creates a structural advantage for candidates already inside the defense-industrial base. Veterans transitioning from depot maintenance at Tinker or Hill, former SpaceX production engineers who've seen Falcon 9 engines through acceptance test, Navy nuclear-trained machinists who've qualified on submarine reactor components — these populations cluster in specific geographies (Huntsville, Colorado Springs, Dayton, the Bay Area) and specific social graphs. Vendra's hiring funnel, like its peers', likely captures a disproportionate share of candidates from these clusters not because of bias but because the signal-to-noise ratio of a warm introduction from a trusted operator is orders of magnitude higher than a LinkedIn Easy Apply. The research on Beacon suggests the market is waking up to this: formalizing referral payouts, tracking referral quality, treating network intelligence as a sourcing channel worth paying for. But in defense-tech, the platform layer may never fully replace the handshake layer. The clearance, the program experience, the "I know this person's work on the F-35 line" — that trust transfers peer-to-peer, not through a marketplace.

For the roles Vendra has open, spanning manufacturing engineering, quality, supply chain, and software, the referral path likely looks less like a bonus program and more like a senior engineer texting a former colleague: "We need someone who actually understands MIL-STD-461 EMI testing on flight hardware. You know anyone?" That message moves faster than any ATS. The candidate who gets that text enters the funnel with a champion already invested. In a market where the technical bar is high and the citizenship gate is absolute, that champion is often the difference between a resume that gets read and one that doesn't.

The Gate Holds

A candidate clears the citizenship filter, proves they've shipped hardware through qualification, shows a portfolio organized by program rather than project, and gets a text from a former colleague who knows their work on the F-35 line. They sit down for a technical screen with a Vendra founder who asks them to design an enclosure that meets that same environmental spec — not as a puzzle, but as a proxy for the judgment they'll need when the platform's LLM suggests a manufacturing process for a $50,000 part destined for orbit.

The funnel doesn't widen. It verifies.

Working in frontier tech? Zero G Talent tracks the openings: see every open ASML role, browse frontier tech jobs, openings at Stripe, and the people building the field.