Senior Software Engineer – Virtual Network Security Appliance (C++ / Go / Rust)

Senior Software Engineer – Virtual Network Security Appliance (C++ / Go / Rust) Hybrid – Pune, India · Full-time, direct hire · Rust · C/C++ · Go · Linux networking · Containers · AWS The role You'll build and own Securly's edge proxy appliance: a virtual appliance (containers on a minimal Linux OS image) that we deliver into customers' school networks to intercept, inspect, and filter web traffic. You own it end to end: the traffic-handling datapath, how it's packaged and shipped, how it updates itself safely, how it fails without cutting off a network, and how the deployed fleet reports back to our AWS control plane. This is a senior role in Pune Engineering, reporting to the SVP of Engineering. You'll bring You've shipped software that runs inside a customer's network, such as a proxy, firewall, secure web gateway, VPN gateway, load balancer, or network security appliance. We're open to strong C/C++ or Go engineers whose Rust is still growing, as well as Rust engineers with appliance or proxy experience. 8+ years of software engineering in systems, networking, or security products Production experience in Rust, C/C++, or Go. Rust is where the new proxy is headed, so you'll write Rust here. Network programming below the HTTP layer: TCP streams, sockets, bidirectional forwarding, transparent proxying (TPROXY), TLS, and the Linux network stack A shipped appliance, proxy, or network security product you can name, and the problems you solved on it Containerization and software delivery into customer networks: Docker image builds, minimal Linux images, container networking, installs and upgrades Network security fundamentals: TLS, mTLS, certificates, and hardening systems against tampering Performance testing and profiling: load tests, CPU/memory profiling, flame graphs Working knowledge of AWS and infrastructure as code (CloudFormation or Terraform) Strongly preferred: production Rust (async, Tokio); Linux kernel networking (eBPF/XDP, netfilter, routing); HAProxy or Envoy; OTA or fleet management at scale; high-availability design (watchdogs, VRRP/CARP failover). Nice to have: RADIUS; fleet messaging (gRPC over mTLS, MQTT, AWS IoT Core); observability (CloudWatch, Splunk, SLO definitions); immutable OS images (Flatcar, Talos, Buildroot). What you'll build Proxy datapath: TCP interception, transparent proxying, and TLS inspection, plus Linux network stack tuning for throughput and latency. Appliance packaging and delivery: Container images and a minimal, immutable OS image that installs and runs cleanly inside customer networks. Safe updates: Zero-downtime OTA updates with A/B swaps, automatic health-check rollbacks, and phased canary rollouts to machines you can't log into. Fail-open and high availability: Watchdogs, failover, and bypass logic so the customer's internet keeps working if the appliance doesn't. Fleet control plane: Secure, low-latency channels for policy updates and telemetry between deployed appliances and AWS.