Initial job-flox surface: open roles, public surface, Flox x Speckl artifact plan, empty outreach log.
- 4 open roles captured verbatim from flox.dev/careers + Ashby - Founders + 23-person team mapping with GH handles - Recent flox/flox issues + blog posts that map to Scott's positioning - Hiring-manager inference (Head of Business for Sales, CTO for Security, VP Marketing for DevRel/PMM) - Flox x Speckl artifact plan: declarative env -> compile to .speckdl + PROV-O/CycloneDX/SPDX - Outreach log empty by directive (do not contact)
This commit is contained in:
Scott Scoble
commit
9fc77f98db
1 changed files with 203 additions and 0 deletions
203
README.md
Normal file
203
README.md
Normal file
|
|
@ -0,0 +1,203 @@
|
|||
# job-flox
|
||||
|
||||
> Flox is Scott Scoble's job-pipeline bucket for **reproducible dev environments, declarative systems, and supply-chain integrity**. This repo is the surface — open roles, founders, engineering handles, recent GH activity, the Flox x Speckl artifact plan, and an outreach log (currently empty — no contact made).
|
||||
|
||||
Source: flox.dev/about/careers/ + jobs.ashbyhq.com/flox + github.com/flox + LinkedIn (floxdev). Captured 2026-06-18.
|
||||
|
||||
---
|
||||
|
||||
## Why Flox (audience fit)
|
||||
|
||||
Flox is **Nix-bounded reproducible dev environments for teams** — CLI + FloxHub (flake catalog) + a Nix-backed environment model. They ship SBOMs and provenance natively, target regulated Fortune-100 buyers, and publicly frame the product as **"secure software by construction."** Three direct lines of fit with Scott's positioning:
|
||||
|
||||
| Scott's pillar | Flox surface |
|
||||
|---|---|
|
||||
| Reproducible dev environments | Flox CLI / FloxHub / `[install]` / `flox activate` |
|
||||
| Declarative systems | SpeckDL is `.speckdl`-declarative; Flox envs are manifest-declarative — same shape |
|
||||
| Supply-chain integrity | "SBOMs and provenance included" (verbatim from their job posts); CVE-remediation blog series |
|
||||
|
||||
Both sides are solving **the same problem from opposite ends**: Flox owns *what runs*; Speckl owns *why it was decided*. The artifact plan in section 3 shows how a Flox environment compiles to a SpeckDL spec + PROV-O/CycloneDX/SPDX manifest — that's the reproducibility story neither has shipped alone.
|
||||
|
||||
---
|
||||
|
||||
## 1. Open roles (verbatim from flox.dev/careers + Ashby)
|
||||
|
||||
All four roles are public, Full-Time, on Ashby (`jobs.ashbyhq.com/flox`). Source of truth for descriptions lives there; this is the snapshot.
|
||||
|
||||
### 1.1 Developer Relations Lead
|
||||
- **Dept:** Marketing
|
||||
- **Location:** SF / NYC or Remote (Pacific / Eastern preferred)
|
||||
- **Workplace:** Remote
|
||||
- **Travel:** 20-40 percent
|
||||
- **Published:** 2026-05-27
|
||||
- **Ashby:** https://jobs.ashbyhq.com/flox/132d3ea8-d91b-4da1-b564-0cf1ccd7b2a8
|
||||
- **Snippets (verbatim):** *"you'll be the public, technical, and human face of Flox to software engineers and builders worldwide. You'll build integrations, demos, proof-of-concepts, and real technical deliverables that showcase what's possible with Flox… While this is not a sales role, you'll naturally surface new opportunities through advocacy, education, and technical partnership by translating community engagement into qualified interest and adoption."*
|
||||
|
||||
### 1.2 Security Engineer
|
||||
- **Dept:** Engineering
|
||||
- **Location:** Remote (US)
|
||||
- **Workplace:** Remote
|
||||
- **Published:** 2026-04-28
|
||||
- **Ashby:** https://jobs.ashbyhq.com/flox/37ec9578-4fab-432f-88f1-c130ffe13ac8
|
||||
- **Snippets:** *"This is Flox's first dedicated security hire. You'll work directly with engineering leadership to stand up security practices that are pragmatic, developer-friendly, and right-sized for a company at our stage… our product sits at the heart of the software supply chain — managing dependencies, environments, and build artifacts for some of the world's largest engineering teams — security isn't peripheral here. It's core to the value we deliver."*
|
||||
|
||||
### 1.3 Solutions Engineer
|
||||
- **Dept:** Sales
|
||||
- **Location:** NYC (hybrid); secondary SF
|
||||
- **Travel:** up to 30 percent
|
||||
- **Reports to:** Head of Business
|
||||
- **Published:** 2026-04-27
|
||||
- **Ashby:** https://jobs.ashbyhq.com/flox/70d9f106-7c50-4834-b56d-370c31957237
|
||||
- **Snippets:** *"Flox is a Series B startup… running in production at Fortune 100 companies… you're the person who can sit across from a staff engineer at a Fortune 5 company, open a terminal, and earn trust in the first ten minutes."*
|
||||
|
||||
### 1.4 Technical Product Marketing Lead
|
||||
- **Dept:** Marketing
|
||||
- **Location:** Remote (NYC or SF secondary)
|
||||
- **Workplace:** Remote
|
||||
- **Published:** 2026-04-22
|
||||
- **Ashby:** https://jobs.ashbyhq.com/flox/b8c61146-8681-40d5-bb0b-6fde6578fcf3
|
||||
- **Snippets:** *"Flox is building the next generation of software development lifecycle tooling. We help teams create secure software by construction — managing all software and its dependencies down to the smallest package, with SBOMs and provenance included."*
|
||||
|
||||
### 1.5 Notable absences
|
||||
- No backend / distributed-systems / SRE role open right now (despite the blog cadence around Slurm, Kubernetes, vLLM serving).
|
||||
- Security role is the only eng opening; their blog cadence (CVE remediation, supply-chain postmortems) suggests a second is plausible in the next quarter.
|
||||
- No open role for Nix/lang engineering explicitly — it's likely folded under the CLI team's open headcount.
|
||||
|
||||
---
|
||||
|
||||
## 2. Public surface (founders, engineering handles, recent activity)
|
||||
|
||||
### 2.1 Founders and leadership (from flox.dev/about)
|
||||
|
||||
| Name | Role | GH handle | LinkedIn slug |
|
||||
|---|---|---|---|
|
||||
| **Ron Efroni** | CEO / co-founder | `refroni` (floxdev.com) | linkedin.com/in/ron-efroni (handle exists, auth-walled) |
|
||||
| **Michael Brantley** | CTO / co-founder | `michael-brantley` (login dormant; no public repos since 2020) | linkedin.com/in/michaelbrantley (page exists, 200) |
|
||||
| **Brendan Magee** | Engineering (public GH member) | `brendaneamon` | — |
|
||||
| **Stephen Yeargin** | Engineering (public GH member) | `stephenyeargin` | — |
|
||||
| Daniel Sauble | Product | `djsauble` | — |
|
||||
| Bill LeVine | Engineering | `billlevine` | — |
|
||||
| Dan Carley | Engineering | `dcarley` | — |
|
||||
| Gil Mishal | Engineering | `gilmishal` | — |
|
||||
| Rok Garbas | Engineering | `garbas` | — |
|
||||
| Matthew Kenigsberg | Engineering | `mkenigs` | — |
|
||||
|
||||
**Full 23-person team listing** (from `/about/`): Alejandro Vogel (Ops), Ben Futoriansky (Ops), Bill LeVine (Eng), Brendan Magee (Eng), Dan Carley (Eng), Daniel Sauble (Product), Gil Mishal (Eng), James Bayer (Product), Joanna Kasprzak (Marketing), Kanishk Sahni (Product), Katherine Saunders (Ops), Matthew Kenigsberg (Eng), Michael Brantley (CTO), Morgan Helton (Eng), Nick Lewis (Eng), Robin Brantley (Ops), Rok Garbas (Eng), Ron Efroni (CEO), Stephen Yeargin (Eng), Steve Morin (Eng), Steve Swoyer (Marketing), Tanja Ulianova (Eng), Yannik Sander (Eng).
|
||||
|
||||
**Investors:** DESCOvery (D. E. Shaw group's venture studio), NEA, Hetz Ventures, Addition Ventures. Angels: Thomas Dohmke (former GitHub CEO), Guy Podjarny (Snyk founder), James Turnbull (former VP Docker / CTO Sotheby's).
|
||||
|
||||
**Origin:** Flox was built originally to solve Nix-adoption problems at D. E. Shaw; became one of the largest enterprise Nix deployments before spinning out.
|
||||
|
||||
### 2.2 GitHub org stats (`github.com/flox`)
|
||||
- **117 public repos**, 178 followers, org verified.
|
||||
- **Flagship:** `flox/flox` — 4,017 stars, 440 open issues, Rust, last commit today.
|
||||
- Other active repos: `floxpkgs.v1` (17 stars, Nix), `install-flox-action` (13 stars, JS), `flox-agentic` (11 stars, recently active), `flox-vscode` (9 stars, TS), `floxdocs` (7 stars, Python), `capacitor` (9 stars, Nix), `sbomnix` (SBOM tool), `floxenvs` (community env catalog).
|
||||
- **Top recent committers on `flox/flox` (last 30 commits):** djsauble (11), billlevine (5), dcarley (4), brendaneamon (3), gilmishal (3), stephenyeargin (1).
|
||||
- **Public members:** `brendaneamon`, `stephenyeargin` only.
|
||||
|
||||
### 2.3 Recent issues (themes Scott can mirror)
|
||||
Pulled `flox/flox` open issues — most are CLI polish; notable themes:
|
||||
- `team-cli`, `activation`, `direnv` — activation/deactivation ergonomics (#4174 direnv broken since 1.9.0)
|
||||
- `team-cli, performance, buildenv` — evaluation perf (#4306 perf: move stat check to before semaphore acquisition)
|
||||
- `team-cli, bug, CLI, activation` — auto-activation consent (#4405 feat(hook-env): prompt for consent before auto-activating DEV-132)
|
||||
- `team-cli, docs` — agent codegen conventions (#4406 docs: add testing and API contract conventions to AGENTS.md)
|
||||
- `team-cli, bug` — backward-compat regression on `flox run` (#4400 fix(gen-data): Reliable unit mock regeneration)
|
||||
- **Most active issue area right now:** `activation` ergonomics + `agentic` codegen — both map directly to Flox's marketing tagline "BYOA Needs a Floor" and the `flox-agentic` repo.
|
||||
|
||||
### 2.4 LinkedIn
|
||||
- Company slug: `linkedin.com/company/floxdev` (4,518 followers).
|
||||
- CEO Ron Efroni's LinkedIn slug is `ron-efroni` (returns 999/auth-wall when scraped — handle exists).
|
||||
- No public engineering handles discoverable without auth.
|
||||
|
||||
### 2.5 Recent blog posts that map to Scott's positioning (flox.dev/blog)
|
||||
- 2026-06-15 — *"Training nanoGPT on Slurm with a Nix-Pinned Environment"* (Engineering)
|
||||
- 2026-06-04 — *"A Pattern for Local Dev: Runtime on the Host, Services in Containers"* (Engineering)
|
||||
- 2026-05-01 — *"Achieving CVE Remediation in an Era of Escalating Vulneratives"* (Engineering)
|
||||
- 2026-04-15 — *"Reproducible Flox Environments for the First and the Last Mile of AI"* (Guides)
|
||||
- 2026-03-26 — *"Flox and Containers: A Perfect Pattern for Local Development"* (Guides)
|
||||
- 2026-03-18 — *"BYOA Needs a Floor. That Floor Is Flox."* (Announcement) — Scott's "judgment transport utility" framing slots cleanly next to this.
|
||||
- 2026-02-24 — *"Kubernetes, Uncontained: Unlocking Faster, More Reproducible Deployments on K8s"* (Guides)
|
||||
- 2025-12-12 — *"Reproducible Development Environments in Any Repo with AI Agents and Flox: Part 1 and Part 2"*
|
||||
|
||||
### 2.6 Hiring manager / "who would review this resume"
|
||||
- **Head of Business** is named on the Solutions Engineer posting as the direct manager — Solutions Engineer reports up through Sales.
|
||||
- **Engineering leadership** for the Security Engineer role is the CTO (**Michael Brantley**) by structure (first dedicated eng security hire).
|
||||
- **DevRel Lead** sits inside Marketing, reports to Joanna Kasprzak (VP Marketing) by org chart inference (she's the only named Marketing lead).
|
||||
- **Technical PMM Lead** is also under Marketing.
|
||||
- **No recruiter handle** is exposed publicly on Ashby; the apply URLs all route through `jobs.ashbyhq.com/flox/{job-id}/application` (anonymous).
|
||||
|
||||
---
|
||||
|
||||
## 3. Artifact plan — Flox x Speckl (the "neither has shipped alone" reproducibility story)
|
||||
|
||||
### 3.1 The pitch in one paragraph
|
||||
A Flox environment is a *declarative runtime manifest* — the inputs that go into a Nix store path. A Speckl `.speckdl` spec is a *declarative behaviour manifest* — the intent that goes into a TypeScript class. Today they live in separate worlds. The artifact we ship proves they can compile together: a single Flox environment that resolves its Nix deps to content-addressed store paths, then feeds those paths (and the source-of-truth `.speckdl` file) into the Speckl compiler, which emits a TypeScript class **plus** a PROV-O / CycloneDX / SPDX provenance manifest. The result is a *byte-identical* dev environment with *byte-attributable* semantics — "this is what's running" and "this is why" in the same artifact.
|
||||
|
||||
### 3.2 Deliverable (skeleton)
|
||||
A single repo (this one) with:
|
||||
1. `flox/manifest.toml` — Flox environment manifest pinning the Speckl compiler + Nix + Node toolchain.
|
||||
2. `specs/<name>.speckdl` — at least one `.speckdl` file (a real spec, not a stub). Good candidate: `OAuth2AuthorizationCode` (already in `sscoble/speckl/examples`) or a new spec for an *environment-introspection* state machine.
|
||||
3. `scripts/build.sh` — single command that runs inside the Flox env, invokes the Speckl compiler, emits the four-artifact bundle.
|
||||
4. `out/<name>.prov-o.jsonld` + `out/<name>.cyclonedx.json` + `out/<name>.spdx.json` — committed, byte-stable.
|
||||
5. `docs/reproducibility.md` — a one-page narrative: "I checked out this repo, ran `flox activate`, ran `bash scripts/build.sh`, and got the same SHA-256 hashes Flox's CI got on May 14. Here's the chain."
|
||||
|
||||
### 3.3 Mapping to Flox's actual primitives
|
||||
| Flox surface | What it does in this artifact |
|
||||
|---|---|
|
||||
| `manifest.toml` `[install]` | Pins `nodejs@22`, `nix`, `git`, the Speckl compiler tarball by URL+SHA |
|
||||
| `manifest.toml` `[vars]` | `SPECKL_REF`, `SPECKDL_SRC`, `OUT_DIR` — fed to `scripts/build.sh` |
|
||||
| `[hooks]` activation | On `flox activate`, exports env, validates toolchain hashes, runs a one-time self-test |
|
||||
| FloxHub publish step | The compiled `.prov-o.jsonld` artifact is published alongside the env as `flox/flox-vscode`-style deliverable |
|
||||
| Nix store path | Flox's input-addressed store path IS the "what's running" half of the provenance chain |
|
||||
|
||||
### 3.4 Mapping to Speckl's compiler output
|
||||
The Speckl compiler already emits four artifacts per `.speckdl` source. We just feed it a Flox-resolved source path. The compiler is deterministic, so `same input → same four outputs, byte-identical, hash-stable`.
|
||||
|
||||
### 3.5 Why neither side has shipped this alone
|
||||
- **Flox has the deterministic runtime** but does not yet emit a *behavioural* provenance graph — their `sbomnix` is package-level, not spec-level.
|
||||
- **Speckl has the deterministic provenance** for *AI-generated specs*, but the *runtime substrate* that hosts the compiled TypeScript is whatever you bring (Docker, k8s, Nix). Today that's not content-addressed.
|
||||
- **The pair** = Flox is the floor, Speckl is the blueprint. Together: "I can prove what my AI wrote, and I can prove where it ran."
|
||||
|
||||
### 3.6 Outreach angle (when the time comes)
|
||||
Not for the apply form. For:
|
||||
- **CEO Ron Efroni** (`refroni`) — the "BYOA Needs a Floor" blog post is the literal hook. Speckl is the equivalent floor *for the spec layer*.
|
||||
- **CTO Michael Brantley** (`michael-brantley`) — Speckl's PROV-O/CycloneDX/SPDX output pairs with Flox's `sbomnix` for a full-stack supply-chain story.
|
||||
- **DevRel Lead (open role)** — the artifact itself IS a deliverable: a public Flox env that compiles a Speckl spec to four provenance artifacts. That's exactly the "real technical deliverables that showcase what's possible with Flox" the JD calls for.
|
||||
- **Security Engineer (open role)** — this artifact is a working reference for what "secure software by construction" means at the *spec* layer, not just the package layer.
|
||||
|
||||
### 3.7 Status
|
||||
Plan only. No artifact built yet. When built, the artifact lives at `sscoble/speckl` (compiler) + this repo (Flox env). Build sequence:
|
||||
1. Choose a `.speckdl` spec that's small enough to audit end-to-end (suggest: a fresh `EnvironmentIntrospection.speckdl` modelling the flox env itself).
|
||||
2. Write the `manifest.toml` pinning the compiler version (current Speckl compiler release).
|
||||
3. Get the SHA-256 chain to be byte-stable across two Flox activations on different hosts.
|
||||
4. Publish the artifact as a FloxHub catalogue entry.
|
||||
5. Write the `reproducibility.md` narrative as a blog-post-shaped artifact that doubles as the outreach asset.
|
||||
|
||||
---
|
||||
|
||||
## 4. Outreach log (empty — do not contact)
|
||||
|
||||
> Per directive: surface only. No contact made. This section is a placeholder; entries will be appended as the artifact matures and a single warm-intro path is identified (most likely via Ron Efroni's blog audience, not via the apply form).
|
||||
|
||||
| Date | Channel | Target | Topic | Outcome |
|
||||
|------|---------|--------|-------|---------|
|
||||
| - | - | - | - | - |
|
||||
|
||||
---
|
||||
|
||||
## 5. Source URLs (cited for verification)
|
||||
|
||||
- Careers: https://flox.dev/careers/
|
||||
- About / team: https://flox.dev/about/
|
||||
- Blog: https://flox.dev/blog/
|
||||
- Job board (Ashby): https://jobs.ashbyhq.com/flox (and `https://api.ashbyhq.com/posting-api/job-board/flox` for JSON)
|
||||
- LinkedIn company: https://www.linkedin.com/company/floxdev/
|
||||
- GitHub org: https://github.com/flox
|
||||
- Flagship repo: https://github.com/flox/flox
|
||||
- CEO GH: https://github.com/refroni
|
||||
- CTO GH: https://github.com/michael-brantley
|
||||
- Speckl compiler (the pairing): https://os.scoble.me/forgejo/sscoble/speckl
|
||||
|
||||
---
|
||||
|
||||
*Repo created by Marcus (job-pipeline agent) on 2026-06-18 from /home/sscoble/job-pipeline/job-flox. Surfacing only — no contact made.*
|
||||
Loading…
Add table
Add a link
Reference in a new issue