C++ Network Engineer

Persistent; Pune District; On-site; INR 3,500,000 - 7,000,000; Full time

Benefits offered by this job

Competitive salary package

Hybrid work model

Professional growth opportunities

Job summary

Persistent is seeking an R&D Engineer to join a team building real-time decryption for encrypted network traffic in our analytics platform. You will work on TLS/DTLS and IPSec decryption at wire speed, with multi-threaded C++ in containerized, Kubernetes-based environments.

The role combines network security concepts, cryptography, and high-performance systems programming. Prior experience with OpenSSL/GnuTLS, Docker, Kubernetes, and CI/CD is essential.

Qualifications

• Experience designing and implementing real-time decryption pipelines and TLS/DTLS handling.
• Proficiency with multi-threaded C++ in low-latency environments and containerized deployment.
• Hands-on cryptography library integration (OpenSSL/GnuTLS) and key management work.

Responsibilities

• Design, implement, and optimize real-time TLS/DTLS decryption and session handling.
• Maintain IPSec decryption pipelines, SAD lookups, and ESP decryption.
• Develop key management subsystems and REST/binary interfaces for key streaming.
• Integrate cryptographic libraries and ensure compatibility with cipher suites and protocol versions.
• Optimize DPDK-based ingestion and ensure robust test coverage and CI workflows.

Skills

C++

Latency-sensitive

Multi-threaded

TLS/DTLS knowledge

Rust/Networking patterns

Git

CI/CD

Docker

Kubernetes

Helm

ZMQ

Prometheus/Grafana

REST APIs

OpenSSL/GnuTLS

DPDK

PKCS#11/PKI

Graph-based processing

Education

Bachelor's or Master's degree in CS/EE/Info Security

Tools

OpenSSL

GnuTLS

DPDK

ZMQ

Make

Conan

Docker

Kubernetes

Helm

Job description

About Position:

We are looking for an R&D Engineer to join the team responsible for real-time decryption of encrypted network traffic within our network analytics platform. The components you will work on intercept and decrypt live TLS (1.0 through 1.3) and IPSec flows at wire speed, then forward the plaintext packets to the downstream processing pipeline. The role sits at the intersection of network security protocols, high-performance C++ systems programming, and cryptographic library integration. You will work on low-latency, multi-threaded decryption engines that operate in containerized environments on bare-metal Kubernetes nodes.

• Role: C++ Network Engineer
• Location: All Persistent Location
• Experience: 7 to 15 Years
• Job Type: Full-Time Employment

What You'll Do:

• Design, implement, and optimize real-time TLS decryption, including TCP stream reassembly, TLS handshake parsing, session key derivation, and symmetric decryption of application data.
• Maintain and extend the IPSec decryption pipeline, including graph-based packet processing, Security Association database (SAD) lookup, ESP decryption, and IP fragment reassembly.
• Develop and maintain the key management subsystem, including private key loading and rotation, session ticket and session ID tracking, and dynamic key streaming via REST and binary record interfaces.
• Integrate and maintain cryptographic library dependencies (GnuTLS, OpenSSL) and keep up with evolving cipher suite and protocol version requirements.
• Optimize DPDK-based packet ingestion for the decryption engines, including RX queue workers, packet dispatching, and ZMQ output to downstream processing.
• Write and maintain unit and integration tests covering protocol edge cases, key rotation scenarios, and performance regression detection.
• Maintain Helm charts and Docker packaging for Kubernetes deployment of the decryption components.
• Participate in code reviews, contribute to architecture discussions, and maintain technical documentation.

Expertise You'll Bring:

• C++ (Primary Language)
• Proficiency in modern C++ (C++17 or later).
• Experience writing latency-sensitive, multi-threaded systems code.
• Solid understanding of RAII, smart pointers, std::span / std::string_view, and STL algorithms.
• Ability to write correct, efficient code with minimal dynamic allocation on the hot path.
• Familiarity with node/graph-based processing pipeline patterns.
• In-depth understanding of the TLS protocol, including handshake (RSA, ECDHE), session tickets, session IDs, cipher suites, and record layer decryption across TLS 1.01.3.
• Working knowledge of IPSec, including ESP and AH encapsulation, Security Association concepts, and IKE key exchange basics.
• Understanding of TCP/IP stream reassembly and IP fragment handling.
• Hands-on experience with GnuTLS and/or OpenSSL libraries.
• Understanding of asymmetric cryptography (RSA, ECDSA), X.509 certificates, and PKCS#11.
• Experience with key material streaming or out-of-band key injection patterns, such as key log files and REST-based key delivery.
• Experience with DPDK poll-mode drivers for high-throughput packet ingestion (desirable; training provided if not already held).
• Familiarity with ZeroMQ (ZMQ) for inter-process message passing.
• Strong understanding of Linux networking fundamentals, including packet flow, socket programming, and raw packet handling.
• Experience with Docker for containerising applications and managing multi-stage builds (mandatory).
• Experience with Kubernetes and Helm, including deploying workloads and authoring Helm charts (nice to have).
• Experience with Git and CI/CD pipelines for version control and automated build, test, and release workflows (mandatory).
• Knowledge of build systems including Make and Conan (C++ dependency management).
• Experience with automated integration testing using traffic replay and pcap-based test harnesses.
• Familiarity with REST API design for key streaming interfaces.
• Experience with DTLS (Datagram TLS) decryption.
• Knowledge of SR-IOV or other hardware-accelerated packet acquisition methods.
• Background in telecom network protocols, including SIP, RTP, HTTP/2, and Diameter carrying encrypted payloads.
• Experience with hardware security modules (HSMs) or PKCS#11 token integration.
• Experience profiling and analysing cryptographic workloads, including OpenSSL speed benchmarks, perf, and flamegraphs.
• Familiarity with Prometheus and Grafana for metrics collection and operational monitoring.
• Bachelor's or Master's degree in Computer Science, Electrical Engineering, Information Security, or equivalent practical experience in systems or security software development.

Benefits:

• Competitive salary and benefits package
• Culture focused on talent development with quarterly growth opportunities and company-sponsored higher education and certifications
• Opportunity to work with cutting-edge technologies
• Employee engagement initiatives such as project parties, flexible work hours, and Long Service awards
• Annual health check-ups
• Insurance coverage: group term life, personal accident, and Mediclaim hospitalization for self, spouse, two children, and parents

Values-Driven, People-Centric & Inclusive Work Environment:

Persistent is dedicated to fostering diversity and inclusion in the workplace. We invite applications from all qualified individuals, including those with disabilities, and regardless of gender or gender preference. We welcome diverse candidates from all backgrounds.

• We support hybrid work and flexible hours to fit diverse lifestyles.
• Our office is accessibility-friendly, with ergonomic setups and assistive technologies to support employees with physical disabilities.
• If you are a person with disabilities and have specific requirements, please inform us during the application process or at any time during your employment

Let's unleash your full potential at Persistent - persistent.com/careers

"Persistent is an Equal Opportunity Employer and prohibits discrimination and harassment of any kind."