Principal Software Engineer — Threat Detection Platform

SonicWall  is a cybersecurity forerunner with more than 30 years of expertise and is recognized as a leading partner-first company, ensuring our partners and their customers are never alone in the fight against cybercrime. With the ability to build, scale and manage security across the cloud, hybrid and traditional environments in real-time, SonicWall provides relentless security against the most evasive cyberattacks across endless exposure points for increasingly remote, mobile and cloud-enabled users. With its own threat research center, SonicWall can quickly and economically provide purpose-built security solutions to enable any organization—enterprise, government agencies and SMBs—around the world. For more information, visit  www.sonicwall.com  or follow us on  Twitter ,  LinkedIn ,  Facebook  and  Instagram .

We are seeking an experienced Principal Software Engineer to lead the architecture, development, and evolution of a large-scale malware analysis and cybersecurity platform. This role will own the end-to-end technical architecture across Python-based analysis pipelines, C/C++ components, message-driven job orchestration systems, Windows VM sandbox environments, and web-based interfaces.

The ideal candidate brings deep expertise in software engineering, malware analysis, and distributed systems, with a proven ability to take ownership of complex legacy platforms and drive modernization initiatives. You will lead the design and implementation of advanced detection capabilities, including behavioral analysis, malware sandboxing, machine learning-based classification, and support for new file types, while ensuring platform scalability, reliability, and performance.

This position requires strong hands-on development skills in Python and C/C++, experience with Linux-based production environments, messaging architectures such as RabbitMQ, virtualization technologies, and cloud-native deployment practices. As the technical leader for the platform, you will establish engineering standards, guide architectural decisions, reduce technical debt, mentor senior engineers, and ensure the long-term maintainability and success of the system.

Responsibilities

Own the end-to-end technical architecture of the malware analysis cloud infrastructure platform: the Python analysis pipeline, C/C++ components, and the TypeScript web UI

Lead design and implementation of new detection capabilities — new analysis engines, ML-based classifiers, behavioral analysis enhancements, and new file type support

Drive the evolution of the job orchestration pipeline (RabbitMQ-based task and job dispatch, policy-driven engine scheduling) for improved throughput, reliability, and detection accuracy

Own the Windows VM sandbox subsystem: KVM/libvirt VM lifecycle, guest initialization, behavioral log collection, and result reporting

Make authoritative calls on technical debt — identify and retire dead code, rationalize the codebase, and reduce maintenance surface

Define and enforce coding standards, testing strategy, and code review practices for the team

Own the full software delivery lifecycle: design, implementation, integration testing, Docker/Debian packaging, and deployment to Ubuntu production environments

Monitor system health via log aggregation and metrics dashboards; drive root-cause resolution of production issues

Produce and maintain internal technical documentation sufficient for the team to operate and extend the system independently

Mentor and provide technical direction to the two Senior Software Engineers on the team

Requirements

At least 10 years of software engineering experience with a Bachelor's degree in Computer Science, Engineering, or a related field; or 8 years with a Master's; or 6 years with a PhD; or equivalent experience

Expert-level Python, including multithreading, packaging, and Cython extensions

Working proficiency in C and C++ sufficient to own the platform's compiled components

Solid experience with message queue architectures (RabbitMQ or equivalent)

Strong background in malware analysis, sandbox systems, or security software — the team will operate without support from the original development team and must be self-sufficient from day one

Familiarity with ML model inference in production: loading and running trained models (PyTorch, LightGBM, or scikit-learn) within a live service

Linux system programming experience; familiarity with KVM/libvirt or equivalent hypervisor technologies is a plus

Proficiency with MySQL (via SQLAlchemy ORM), Redis, and Consul in a production microservices context

Experience with Docker, Jenkins CI/CD, and Debian packaging

Proven ability to independently navigate and take ownership of a large, partially underdocumented legacy codebase

Strong written English for technical documentation and async collaboration with a geographically distributed stakeholder group

#LI-KB7

#LI-Hybrid

#C/C++

#Python SonicWall is an equal opportunity employer.  

We are committed to creating a diverse environment and are an equal opportunity employer. All qualified applicants receive consideration for employment without regard to race, color, ethnicity, religion, sex, gender, gender identity and expression, sexual orientation, national origin, disability, age, marital status, veteran status, pregnancy, or any other basis prohibited by applicable law.

At SonicWall, we pride ourselves on recruiting a diverse mix of talented people and providing active security solutions in 100+ countries.

Applicant Privacy Notice