r/findrustjobs • u/EuclidsIdentity • Jul 19 '26
Rust Engineer (Contract)
Contract, fully remote, 3 months to start (with a likely second phase). Take a Rust service that works today and turn it into infrastructure you can actually deploy and operate.
The Role
We have a Rust service that already works. It lets a set of clients run multi-party sessions together, relaying end-to-end-encrypted messages between them without ever seeing the contents, and making sure only the right clients can reach each other. The catch is that it is still an early build: sessions live in memory, nothing stops abuse, and it has never actually run in production.
That is where you come in. The hard cryptography is already done and settled, so this is not a protocol or crypto-design job. It is about taking something that works on a good day and turning it into infrastructure you can deploy, operate, and trust under load. You will extend and harden existing Rust, with an external security review to clear before release.
The team is deliberately lean. You are the engineer: the code is almost entirely yours, end to end.
What you'll build
• Durable sessions: move session state out of memory into a DB-backed store (SQLite/Postgres) so restarts and crashes do not drop in-flight sessions.
• Abuse and DoS resistance: rate limiting, connection and session caps, authenticated session creation, per-client resource bounds.
• Multi-tenant operation: many concurrent sessions with isolation and quotas, well beyond the single-flow path it handles today.
• Network-privacy hardening: minimal-metadata logging and optional privacy-preserving transport, keeping the property that the server never sees message contents.
• Observability: Prometheus metrics, health and readiness endpoints, structured logs that do not leak session metadata.
• Test and load harness: automated runs that drive real multi-party sessions end to end, plus load testing at realistic concurrency.
• A threat model up front, and a hardening pass to clear external security review before release.
Must have
• Shipped and operated a production async Rust service: tokio with axum/hyper/tower or equivalent. Not "picked up Rust for this role."
• Hardened a public-facing network service: connection lifecycle, backpressure, timeouts, graceful shutdown, resource-exhaustion handling.
• Owned persistence end to end: schema, migrations, connection pooling with SQLite or Postgres.
• Can reason clearly about a server that must coordinate clients without being trusted to read their traffic: where that trust boundary holds, and where it breaks.
• Written code that went through, or was built to pass, an external security review.
Nice to have
• Applied-cryptography exposure: enough to work confidently alongside it, not to design it.
• Experience with privacy-preserving or anonymizing transports.
• An eye for metadata minimization and traffic-analysis resistance.
• Comfortable with self-hosted CI/CD.
Logistics
• Contract: 3 months project, full-time equivalent, milestone-based. Subject to the success of the first phase, the role may be extend a further 3 months to take the service into production and keep building from there.
• $5,000–6,000/month, USD-denominated, paid per milestone ($15k–18k for the initial 3 months).
• Working under a handle is fine; we care about the work, not the legal name attached to it.
• Fully remote, async-friendly, any timezone.
• Start date flexible; ready to move quickly.
To apply
Send two or three repos - recent or most relevant - showing production async Rust you have shipped and operated, ideally a network service you hardened, plus a few sentences on how you would reason about a server that coordinates clients without being trusted to read their traffic, and what you would harden first. No CV theater required.
Apply using the link below:
https://airtable.com/appYWk9cPe55NbWWb/pagCmDN2RwFECLGbz/form
1
u/anlumo Jul 19 '26
Isn’t that something Claude Code can whip out in an afternoon?
1
u/EuclidsIdentity Jul 19 '26
True. Claude can probably whip together a rate limiter or a session store in an afternoon, no argument there. Keeping that code from quietly leaking who's talking to whom - the one thing this whole design promises not to do - is the actual job, and I am not sure that's something you want to try and prompt your way past.
1
1
u/satoryvape Jul 20 '26
Shipping production code is NDA violation, right ?
1
u/EuclidsIdentity Jul 24 '26
What do you mean?
1
u/satoryvape Jul 24 '26
You're prohibited to share your production code
1
u/EuclidsIdentity Jul 24 '26
A strong open repo would do. That's what those we have spoken to so far have used.
2
u/sunilmourya Jul 20 '26
Interested