SonicWall is a cybersecurity forerunner with more than 30 years of expertise and is recognized as a leading partner-first company, ensuring our partners and their customers are never alone in the fight against cybercrime. With the ability to build, scale and manage security across the cloud, hybrid and traditional environments in real-time, SonicWall provides relentless security against the most evasive cyberattacks across endless exposure points for increasingly remote, mobile and cloud-enabled users. With its own threat research center, SonicWall can quickly and economically provide purpose-built security solutions to enable any organization—enterprise, government agencies and SMBs—around the world. For more information, visit www.sonicwall.com or follow us on Twitter, LinkedIn, Facebook and Instagram.

We are seeking an experienced Principal Software Engineer to lead the architecture, development, and evolution of a large-scale malware analysis and cybersecurity platform. This role will own the end-to-end technical architecture across Python-based analysis pipelines, C/C++ components, message-driven job orchestration systems, Windows VM sandbox environments, and web-based interfaces.

The ideal candidate brings deep expertise in software engineering, malware analysis, and distributed systems, with a proven ability to take ownership of complex legacy platforms and drive modernization initiatives. You will lead the design and implementation of advanced detection capabilities, including behavioral analysis, malware sandboxing, machine learning-based classification, and support for new file types, while ensuring platform scalability, reliability, and performance.

This position requires strong hands-on development skills in Python and C/C++, experience with Linux-based production environments, messaging architectures such as RabbitMQ, virtualization technologies, and cloud-native deployment practices. As the technical leader for the platform, you will establish engineering standards, guide architectural decisions, reduce technical debt, mentor senior engineers, and ensure the long-term maintainability and success of the system.

Responsibilities

Own the end-to-end technical architecture of the malware analysis cloud infrastructure platform: the Python analysis pipeline, C/C++ components, and the TypeScript web UI
Lead design and implementation of new detection capabilities — new analysis engines, ML-based classifiers, behavioral analysis enhancements, and new file type support
Drive the evolution of the job orchestration pipeline (RabbitMQ-based task and job dispatch, policy-driven engine scheduling) for improved throughput, reliability, and detection accuracy
Own the Windows VM sandbox subsystem: KVM/libvirt VM lifecycle, guest initialization, behavioral log collection, and result reporting
Make authoritative calls on technical debt — identify and retire dead code, rationalize the codebase, and reduce maintenance surface
Define and enforce coding standards, testing strategy, and code review practices for the team
Own the full software delivery lifecycle: design, implementation, integration testing, Docker/Debian packaging, and deployment to Ubuntu production environments
Monitor system health via log aggregation and metrics dashboards; drive root-cause resolution of production issues
Produce and maintain internal technical documentation sufficient for the team to operate and extend the system independently
Mentor and provide technical direction to the two Senior Software Engineers on the team

Requirements

At least 10 years of software engineering experience with a Bachelor's degree in Computer Science, Engineering, or a related field; or 8 years with a Master's; or 6 years with a PhD; or equivalent experience
Expert-level Python, including multithreading, packaging, and Cython extensions
Working proficiency in C and C++ sufficient to own the platform's compiled components
Solid experience with message queue architectures (RabbitMQ or equivalent)
Strong background in malware analysis, sandbox systems, or security software — the team will operate without support from the original development team and must be self-sufficient from day one
Familiarity with ML model inference in production: loading and running trained models (PyTorch, LightGBM, or scikit-learn) within a live service
Linux system programming experience; familiarity with KVM/libvirt or equivalent hypervisor technologies is a plus
Proficiency with MySQL (via SQLAlchemy ORM), Redis, and Consul in a production microservices context
Experience with Docker, Jenkins CI/CD, and Debian packaging
Proven ability to independently navigate and take ownership of a large, partially underdocumented legacy codebase
Strong written English for technical documentation and async collaboration with a geographically distributed stakeholder group

#LI-KB7

#LI-Hybrid

#C/C++

#Python

SonicWall is an equal opportunity employer.

We are committed to creating a diverse environment and are an equal opportunity employer. All qualified applicants receive consideration for employment without regard to race, color, ethnicity, religion, sex, gender, gender identity and expression, sexual orientation, national origin, disability, age, marital status, veteran status, pregnancy, or any other basis prohibited by applicable law.

At SonicWall, we pride ourselves on recruiting a diverse mix of talented people and providing active security solutions in 100+ countries.

Applicant Privacy Notice

Principal Software Engineer — Threat Detection Platform

Summary

Required Skills

Details

Description