Senior Rust Backend Engineer — Applied Cryptography & Secure APIs (with some WebAssembly)

OVERVIEW We are building a secure, high-integrity content system from the ground up in Rust. This is a from-scratch build: a Rust backend service and API that encrypts content and issues/verifies signed access grants, plus a smaller client-side WebAssembly component that decrypts content in the browser. The majority of the work is backend/API — the encryption service, key handling, grant issuing and verification, and streaming. The WebAssembly piece is one focused component on top of that, not the center of the role. The core is being written rapidly with the help of AI coding agents supervised by our lead engineer. We want a senior Rust engineer who builds fast but reviews like a security engineer — someone with the instinct to spot the subtle cryptographic flaw, whether in their own code or in generated code. WHAT YOU'LL BUILD The Rust backend service and API: content encryption (AES-256-GCM), key wrapping, and a signed-grant system that authorizes each read Key handling and lifecycle done correctly — nonce/IV discipline, constant-time operations, no key material lingering where it shouldn't Session-bound access: server-side windowing, throttling, and anomaly detection on the API A smaller Rust → WebAssembly component that performs client-side decryption, hardened against reverse-engineering and automated analysis Alongside our lead: review AI-generated Rust for soundness and security — unsafe blocks, FFI boundaries, memory-safety invariants REQUIRED Senior Rust — demonstrable production or open-source work, not tutorial-level Backend / API engineering in Rust — async services (Axum or Actix-web; tokio), typed data access, real production API work Applied cryptography in Rust — hands-on with AEAD (AES-GCM), key wrapping, nonce/IV discipline, constant-time code, and the common misuse pitfalls. Familiarity with ring, aws-lc-rs, and/or RustCrypto (aes-gcm, rsa, sha2, hkdf) Experience reviewing/auditing Rust — unsafe review and soundness analysis Some Rust → WebAssembly — wasm-bindgen / wasm-pack, and an understanding of what Wasm does and does not protect in the browser Fluency in at least one other statically-typed backend/systems language (Java, Kotlin, C++, Swift, or Go) STRONGLY PREFERRED Security research, pen-testing, or anti-tamper / RASP background Wasm obfuscation / diversification (wasm-mutate), LLVM-level obfuscation, or opaque-predicate techniques Byte-level document / binary-format, parsing, or serialization work Experience supervising or reviewing AI-coding-agent output FRAMEWORKS / STACK Rust async backend (Axum or Actix-web; tokio), typed data access (sqlx-style) Crypto: ring / aws-lc-rs / RustCrypto Client component: Rust compiled to WebAssembly via wasm-bindgen / wasm-pack Hardening: wasm-mutate diversification, LLVM-IR obfuscation, symbolic-execution-resistant predicates