About this Principal Software Engineer — Threat Detection Platform role at SonicWall
SonicWall is a cybersecurity forerunner with more than 30 years of expertise and is recognized as a leading partner-first company, ensuring our partners and their customers are never alone in the fight against cybercrime. With the ability to build, scale and manage security across the cloud, hybrid and traditional environments in real-time, SonicWall provides relentless security against the most evasive cyberattacks across endless exposure points for increasingly remote, mobile and cloud-enabled users. With its own threat research center, SonicWall can quickly and economically provide purpose-built security solutions to enable any organization—enterprise, government agencies and SMBs—around the world. For more information, visit www.sonicwall.com or follow us on Twitter, LinkedIn, Facebook and Instagram.
We are seeking an experienced Principal Software Engineer to lead the architecture, development, and evolution of a large-scale malware analysis and cybersecurity platform. This role will own the end-to-end technical architecture across Python-based analysis pipelines, C/C++ components, message-driven job orchestration systems, Windows VM sandbox environments, and web-based interfaces.
The ideal candidate brings deep expertise in software engineering, malware analysis, and distributed systems, with a proven ability to take ownership of complex legacy platforms and drive modernization initiatives. You will lead the design and implementation of advanced detection capabilities, including behavioral analysis, malware sandboxing, machine learning-based classification, and support for new file types, while ensuring platform scalability, reliability, and performance.
This position requires strong hands-on development skills in Python and C/C++, experience with Linux-based production environments, messaging architectures such as RabbitMQ, virtualization technologies, and cloud-native deployment practices. As the technical leader for the platform, you will establish engineering standards, guide architectural decisions, reduce technical debt, mentor senior engineers, and ensure the long-term maintainability and success of the system.
Responsibilities
- Own the end-to-end technical architecture of the malware analysis cloud infrastructure platform: the Python analysis pipeline, C/C++ components, and the TypeScript web UI
- Lead design and implementation of new detection capabilities — new analysis engines, ML-based classifiers, behavioral analysis enhancements, and new file type support
- Drive the evolution of the job orchestration pipeline (RabbitMQ-based task and job dispatch, policy-driven engine scheduling) for improved throughput, reliability, and detection accuracy
- Own the Windows VM sandbox subsystem: KVM/libvirt VM lifecycle, guest initialization, behavioral log collection, and result reporting
- Make authoritative calls on technical debt — identify and retire dead code, rationalize the codebase, and reduce maintenance surface
- Define and enforce coding standards, testing strategy, and code review practices for the team
- Own the full software delivery lifecycle: design, implementation, integration testing, Docker/Debian packaging, and deployment to Ubuntu production environments
- Monitor system health via log aggregation and metrics dashboards; drive root-cause resolution of production issues
- Produce and maintain internal technical documentation sufficient for the team to operate and extend the system independently
- Mentor and provide technical direction to the two Senior Software Engineers on the team
Requirements
- At least 10 years of software engineering experience with a Bachelor's degree in Computer Science, Engineering, or a related field; or 8 years with a Master's; or 6 years with a PhD; or equivalent experience
- Expert-level Python, including multithreading, packaging, and Cython extensions
- Working proficiency in C and C++ sufficient to own the platform's compiled components
- Solid experience with message queue architectures (RabbitMQ or equivalent)
- Strong background in malware analysis, sandbox systems, or security software — the team will operate without support from the original development team and must be self-sufficient from day one
- Familiarity with ML model inference in production: loading and running trained models (PyTorch, LightGBM, or scikit-learn) within a live service
- Linux system programming experience; familiarity with KVM/libvirt or equivalent hypervisor technologies is a plus
- Proficiency with MySQL (via SQLAlchemy ORM), Redis, and Consul in a production microservices context
- Experience with Docker, Jenkins CI/CD, and Debian packaging
- Proven ability to independently navigate and take ownership of a large, partially underdocumented legacy codebase
- Strong written English for technical documentation and async collaboration with a geographically distributed stakeholder group
#LI-KB7
#LI-Hybrid
#C/C++
#Python
SonicWall is an equal opportunity employer.
We are committed to creating a diverse environment and are an equal opportunity employer. All qualified applicants receive consideration for employment without regard to race, color, ethnicity, religion, sex, gender, gender identity and expression, sexual orientation, national origin, disability, age, marital status, veteran status, pregnancy, or any other basis prohibited by applicable law.
At SonicWall, we pride ourselves on recruiting a diverse mix of talented people and providing active security solutions in 100+ countries.
