Senior Engineer — C, inspection engine

About the role

You would work on the engine itself: the code that sits on a firewall's interfaces, decides what a session is, and reaches one verdict about it before the traffic moves on. It runs inline on appliances carrying production traffic, which is the whole difficulty and most of the interest.

What you would do

• Work in the packet path: classification, session state, TLS handling, and the evaluation that turns everything known about a session into a single decision.
• Find and fix faults that only appear under real traffic — a race that needs a busy link, a leak that needs a week, a crash that needs one malformed handshake.
• Keep the cost per packet honest. A feature that is correct and twice as expensive is a feature that gets turned off at the first busy site.
• Write the tests and the instrumentation that let the next person change your code without being afraid of it.

What we are looking for

• Several years writing C that other people depend on, in a systems context — a kernel, a network daemon, an embedded target, a database.
• Comfortable with concurrency and with the debugging that goes with it: you have used a sanitiser, read a core dump, and reasoned about memory ordering rather than guessing.
• You can read a packet capture and know what you are looking at — TCP, TLS, HTTP, DNS.
• Working English, written and spoken. German is welcome and is not required.

Useful, not required

• FreeBSD, or a willingness to like it.
• Experience with a kernel bypass or zero-copy datapath.
• You have shipped something that had to keep running while it was being upgraded.

What we offer

• Problems with a hard edge: it either holds under traffic or it does not, and you find out quickly.
• A codebase small enough to hold in your head, and the authority to change it.
• Hardware on the bench, not a queue for a shared test rig.