Software Engineer, Networking (Agent Infra)

About Baseten

Baseten powers mission-critical inference for the world's most dynamic AI companies, like Cursor, Notion, OpenEvidence, Abridge, Clay, Gamma, and Writer. By uniting applied AI research, flexible infrastructure, and seamless developer tooling, we enable companies operating at the frontier of AI to bring cutting-edge models into production. We're growing quickly and recently raised our $1.5B Series F, led by Altimeter Capital, Conviction Partners, and Spark Capital.

The Role

Every agent on Baseten Sandboxes runs in its own microVM. Agents call models, reach tools and APIs, expose services, and more and more often talk to each other. Networking built into today's cloud providers was not designed for very large numbers of isolated machines that suspend, resume, and exchange data constantly.

The Agent Infra team builds its own networking stack for sandboxes, designed from the start for that scale. It runs in user space, with VPP (FD.io) as its main data plane technology, and is built from virtualized network functions (VNF/NFV): carrier-grade, low-latency packet processing designed for very large numbers of agents. In September 2026, Baseten acquired Blaxel, whose sandboxes, storage, and networking are the foundation for Baseten Sandboxes.

You'll build multi-tenant virtual private networking that connects each customer's agents and services privately and securely, using modern overlay technologies. We want engineers who expose the network as a programmable API and write the code, not operators who push router and switch configuration. This role is separate from Baseten's GPU-to-GPU networking. Here you'll own how sandboxes connect to each other, to Baseten services, to customer networks, and to the internet.

Responsibilities

• Design and build the user-space, VPP-based data plane that connects microVM sandboxes to each other, to Baseten services, and to the internet
• Build multi-tenant virtual private networking and overlays (for example EVPN, GENEVE, VXLAN) across regions
• Expose the network as a programmable API that the rest of the platform calls
• Cut latency and raise connection scale for agent-to-agent and agent-to-service traffic
• Build routing that sends each request to the nearest region and keeps connections working as sandboxes suspend and resume
• Build secure ingress and egress for sandboxes, including firewalling, static egress IPs, and custom domains with managed TLS
• Build L7 proxies for request inspection, filtering, secret injection, and auditing
• Own per-sandbox addressing, including IPv6, and network isolation between tenants
• Build observability for the packet path across guest, host, and network, and debug production issues end to end
• Work closely with the compute, storage, GPU infrastructure, and datacenter teams

Requirements

• Experience with user-space packet processing (DPDK, VPP, or similar) or virtualized network functions (VNF/NFV)
• Experience building multi-tenant networking in production (VXLAN, GENEVE, VRF)
• Experience building a software-defined network, overlay network, or packet-processing data plane in production
• Strong systems programming in Rust, Go, and/or C/C++
• Experience building cloud networking as the provider, not only consuming a cloud provider's network
• Solid grounding in TCP/IP and routing
• Experience building or operating proxies, load balancers, or L4/L7 gateways at scale
• Experience debugging latency and throughput problems with packet captures, tracing, and profiling
• You move fast and like owning a problem end to end on a small team

Nice to Have

• Experience with VPP / FD.io, our main networking technology
• Experience with GENEVE or VXLAN overlays and EVPN
• Linux kernel networking: eBPF/XDP, netfilter or nftables, network namespaces
• Familiarity with virtual machine networking: virtio-net, vhost, TAP devices, or networking for Firecracker or Cloud Hypervisor
• Experience running IPv6 at scale
• Background in telecom user-plane or 5G core networking, or in low-latency trading networks
• Experience with multi-region traffic routing, anycast, or BGP
• Experience with TLS termination, DNS, and egress security controls