Autonomy Software Engineer

About Zipline Zipline is the world’s largest and most experienced drone delivery service. We are on a mission to serve all humans equally by ensuring access to food, medicine and essential goods anytime, anywhere. We design, build, and operate the world’s largest autonomous logistics system, delivering critical supplies quickly and reliably. Today, Zipline operates on four continents, makes a delivery somewhere in the world every 30 seconds, and has completed millions of deliveries to date, including blood, vaccines, medical supplies, food, and retail products. Our customers include the world’s largest and most prominent healthcare systems, governments, retailers, restaurants and global businesses who rely on us to save lives, reduce emissions, increase economic opportunity, and provide delivery from point A to point B as fast as possible. The drone is only 15% of what we’ve built to enable seamless, reliable, global operations. Our system strengthens supply chains, reduces congestion, and gives people time back. With more than 140 million commercial autonomous miles safely flown, Zipline is redefining access to healthcare, consumer products, and food across the globe. We operate at a global scale and are looking for practical problem solvers who thrive on real-world challenges and rapid growth. Our team is motivated by building systems that have a direct, meaningful impact on people’s lives and by scaling the future of logistics. We are seeking people who sculpt from first principles, enjoy facing adversity, and can do the impossible at record breaking speeds.About You & the Role Own the flight-critical runtime that keeps Zipline aircraft in a known safe state—no matter what the world throws at them. You’ll architect and ship the autonomy safety layer that orchestrates missions, detects/diagnoses faults, and executes mitigation and recovery across planning, perception, and controls. This is deep systems work in Rust/C++ with tight real-time constraints: you’ll make high-judgment design decisions, prove them in SIL/HIL and flight logs, and raise the bar on reliability for a global, safety-critical fleet. What You’ll Do Design the mission/flight manager: build the state machines and orchestration logic that govern mission sequencing, safe-state transitions, and behavior gating under latency and resource constraints. Own fault management end-to-end: implement detection, isolation, mitigation, and recovery (FIMR) for sensors, compute, comms, power, and actuation; ensure graceful degradation and continuity of service. Ship flight-critical Rust/C++: develop and maintain core onboard components with strong observability (health, logs, metrics) and testability (deterministic replay, assertions, invariants). Prove safety before flight: define success criteria and build the tooling—scenario libraries, SIL/HIL, log-replay harnesses, fault-injection—to validate behaviors across edge cases and long-tail conditions. Integrate across autonomy: partner with planning, perception, and controls to set interfaces, hazards/assumptions, and escalation paths; codify contracts that the runtime enforces. Close the loop with operations: turn fleet telemetry and incident reviews into requirements and fixes; drive MTBF/MTTR improvements and intervention-rate reductions. Lead with systems judgment: write design docs, perform hazard analysis (e.g., FMEA/STPA-style), run design/PR reviews, and mentor engineers on deep-stack ownership. What You’ll Bring 8+ years building production software for robotics, aerospace, AV, or other safety-critical embedded systems. Expert in Rust and/or C++ (C as a plus) for real-time, fault-tolerant applications on embedded Linux/RTOS. Demonstrated systems thinking: clear interface design, resource budgeting, and trade-offs under timing/safety/power constraints. Hands-on with SIL/HIL, scenario validation, log replay, and fault injection; you measure reliability, not just functionality. Track record of shipping autonomy features (mission logic, supervision, watchdogs, health monitoring) into noisy, dynamic real-world environments. Comfort in HW/SW co-design: you can reason about sensors, compute, comms, and actuators well enough to make robust software decisions. Strong communication and documentation; you make complex safety decisions legible and auditable. 🚫 Not the Right Fit If Your background is primarily web/backend/app platforms with limited embedded or autonomy exposure. You prefer building general cloud tooling over flight-critical runtime software that directly governs vehicles. At Zipline, your code will decide—not just observe. If you’re ready to own the runtime that keeps aircraft safe while we scale autonomous delivery worldwide, we’d love to talk. WHAT ELSE YOU NEED TO KNOW This will be an in-office role based out of our South San Francisco HQs. The starting cash range for this role is $200,000 - $265,000; please note that this is a target, starting cash range for a candidate who meets the minimum qualifications for this role. We are always open to negotiation. The final cash pay for this role will depend on a variety of factors, including a specific candidate's experience, qualifications, skills, working location, and projected impact. The total compensation package for this role may also include: equity compensation; overtime pay; discretionary annual or performance bonuses; sales incentives; benefits such as medical, dental and vision insurance; paid time off; and more. Zipline