Principal Engineer - Ledger Core
MSCI · New York City
You will design and defend the single most important invariant that every quant model on this team ultimately depends on: that money is never created or destroyed as it moves through the system. The Ledger Core is the immutable, append-only, bi-temporal event store that every return, risk figure, and valuation traces back to. This role sets the boundary of the core itself, deciding with precision what belongs inside a small, provably correct kernel and what belongs outside it, and holds that line as the platform scales across asset classes and consuming teams.
What You'll Own
- Storage design: the append-only prefix-KV layout underneath the event log, optimized for write-once, read-many access patterns and long-horizon replay.
- The money model: integer minor units, Int128 arithmetic, and versioned units, so that no rounding or float-drift error can ever enter the book of record a quant model would otherwise inherit.
- Conservation invariant: an exact-integer check enforced at the commit point, not reconciled after the fact.
- Commit protocol: vector-clock based commit ordering and consistent-cut semantics across concurrent writers.
- Core boundary discipline: the ongoing judgment call of what stays inside the immutable kernel versus what is pushed out to plug-in and quant services.
Agentic Development Expectation
This role sets the standard for how the rest of the team uses AI coding agents against the core. Because the ledger's correctness surface is small and its blast radius is large, you will define which parts of the core are safe to delegate to agentic implementation against a written invariant, and which parts require a human holding the pen. Expect to spend real time writing the specs and property tests that make agentic contribution to the core safe rather than expanding scope to accommodate it.
Required Background
- 8+ years building high-integrity, low-level storage or ledger systems in production, ideally in financial infrastructure, payments, or exchange-grade systems.
- Deep fluency in a modern, type-safe systems language (Go, Rust, or similar), with the ability to reason precisely about memory layout, allocation, and concurrency primitives.
- Hands-on experience with event sourcing and append-only log architectures at scale.
- Working command of MVCC, vector clocks, and consistent-cut / distributed-snapshot theory, not just familiarity with the terms.
- A demonstrated bias toward minimal, defensible cores over feature-accreting ones; you can point to a system where you said no to scope and were right to.
Preferred / Bonus
- Prior ownership of a ledger, general ledger engine, or exchange matching/settlement core.
- Experience with formal or semi-formal invariant specification (TLA+, Alloy, or comparable).
- Exposure to private markets or fund accounting data models.