C++ Network Engineer

Persistent Systems; Pune District; Hybrid; INR 3,000,000 - 6,000,000; Full time

Benefits offered by this job

Hybrid work

Growth opportunities

Education sponsorship

Job summary

Persistent Systems is seeking an R&D Engineer to join a team responsible for real-time decryption of encrypted network traffic within our network analytics platform. You will intercept and decrypt live TLS (1.0–1.3) and IPSec flows at wire speed, then forward plaintext to the downstream processing pipeline.

The role sits at the intersection of network security, high-performance C++ systems programming, and cryptographic library integration.

Qualifications

• Expertise in real-time TLS/DTLS decryption and protocol handling.
• Able to design multi-threaded, low-latency C++ systems with careful memory use.
• Experience with cryptographic libraries (OpenSSL/GnuTLS) and TLS/IPSec.
• Hands-on with containerization and Kubernetes deployments.

Responsibilities

• Design, implement, and optimize real-time TLS decryption and TLS handshake parsing.
• Maintain IPSec decryption pipeline and key management interfaces.
• Integrate cryptographic libraries and ensure up-to-date cipher suites.
• Improve DPDK-based ingestion, ZMQ messaging, and network packet handling.
• Maintain Helm charts and Docker packaging for Kubernetes deployment.
• Write unit and integration tests and participate in code reviews.

Skills

C++

C++17+

Low-latency

RAII

Smart Pointers

Span/StringView

STL Algorithms

OpenSSL

GnuTLS

TLS/SSL

IPSec

TCP/IP

Kubernetes

Docker

Helm

Git

CI/CD

Make

Conan

ZeroMQ

REST

DTLS

PKCS#11

SIP/RTP/HTTP/2

Education

Bachelor/Master in CS/EE/InfoSec

Tools

OpenSSL

GnuTLS

Docker

Kubernetes

Helm

Git

CI/CD

Make

Conan

ZeroMQ

Job description

We are looking for an R&D Engineer to join the team responsible for real-time decryption of encrypted network traffic within our network analytics platform. The components you will work on intercept and decrypt live TLS (1.0 through 1.3) and IPSec flows at wire speed, then forward the plaintext packets to the downstream processing pipeline. The role sits at the intersection of network security protocols, high-performance C++ systems programming, and cryptographic library integration. You will work on low-latency, multi-threaded decryption engines that operate in containerized environments on bare-metal Kubernetes nodes.

• Location: All Persistent Location
• Experience: 7 to 15 Years
• Job Type: Full-Time Employment

What You’ll Do:

• Design, implement, and optimize real-time TLS decryption, including TCP stream reassembly, TLS handshake parsing, session key derivation, and symmetric decryption of application data.
• Maintain and extend the IPSec decryption pipeline, including graph-based packet processing, Security Association database (SAD) lookup, ESP decryption, and IP fragment reassembly.
• Develop and maintain the key management subsystem, including private key loading and rotation, session ticket and session ID tracking, and dynamic key streaming via REST and binary record interfaces.
• Integrate and maintain cryptographic library dependencies (GnuTLS, OpenSSL) and keep up with evolving cipher suite and protocol version requirements.
• Optimize DPDK-based packet ingestion for the decryption engines, including RX queue workers, packet dispatching, and ZMQ output to downstream processing.
• Write and maintain unit and integration tests covering protocol edge cases, key rotation scenarios, and performance regression detection.
• Maintain Helm charts and Docker packaging for Kubernetes deployment of the decryption components.
• Participate in code reviews, contribute to architecture discussions, and maintain technical documentation.

Expertise You’ll Bring:

• C++ (Primary Language)
• Proficiency in modern C++ (C++17 or later).
• Experience writing latency-sensitive, multi-threaded systems code.
• Solid understanding of RAII, smart pointers, std::span / std::string_view, and STL algorithms.
• Ability to write correct, efficient code with minimal dynamic allocation on the hot path.
• Familiarity with node/graph-based processing pipeline patterns.
• In-depth understanding of the TLS protocol, including handshake (RSA, ECDHE), session tickets, session IDs, cipher suites, and record layer decryption across TLS 1.0–1.3.
• Working knowledge of IPSec, including ESP and AH encapsulation, Security Association concepts, and IKE key exchange basics.
• Understanding of TCP/IP stream reassembly and IP fragment handling.
• Hands-on experience with GnuTLS and/or OpenSSL libraries.
• Understanding of asymmetric cryptography (RSA, ECDSA), X.509 certificates, and PKCS#11.
• Experience with key material streaming or out-of-band key injection patterns, such as key log files and REST-based key delivery.
• Experience with DPDK poll-mode drivers for high-throughput packet ingestion (desirable; training provided if not already held).
• Familiarity with ZeroMQ (ZMQ) for inter-process message passing.
• Strong understanding of Linux networking fundamentals, including packet flow, socket programming, and raw packet handling.
• Experience with Docker for containerising applications and managing multi-stage builds (mandatory).
• Experience with Kubernetes and Helm, including deploying workloads and authoring Helm charts (nice to have).
• Experience with Git and CI/CD pipelines for version control and automated build, test, and release workflows (mandatory).
• Knowledge of build systems including Make and Conan (C++ dependency management).
• Experience with automated integration testing using traffic replay and pcap-based test harnesses.
• Familiarity with REST API design for key streaming interfaces.
• Experience with DTLS (Datagram TLS) decryption.
• Knowledge of SR-IOV or other hardware-accelerated packet acquisition methods.
• Background in telecom network protocols, including SIP, RTP, HTTP/2, and Diameter carrying encrypted payloads.
• Experience with hardware security modules (HSMs) or PKCS#11 token integration.
• Experience profiling and analysing cryptographic workloads, including OpenSSL speed benchmarks, perf, and flamegraphs.
• Familiarity with Prometheus and Grafana for metrics collection and operational monitoring.
• Bachelor's or Master's degree in Computer Science, Electrical Engineering, Information Security, or equivalent practical experience in systems or security software development.
• Competitive salary and benefits package
• Culture focused on talent development with quarterly growth opportunities and company-sponsored higher education and certifications
• Opportunity to work with cutting-edge technologies
• Employee engagement initiatives such as project parties, flexible work hours, and Long Service awards
• Insurance coverage: group term life, personal accident, and Mediclaim hospitalization for self, spouse, two children, and parents

Values-Driven, People-Centric & Inclusive Work Environment:

Persistent is dedicated to fostering diversity and inclusion in the workplace. We invite applications from all qualified individuals, including those with disabilities, and regardless of gender or gender preference. We welcome diverse candidates from all backgrounds.

• We support hybrid work and flexible hours to fit diverse lifestyles.
• Our office is accessibility-friendly, with ergonomic setups and assistive technologies to support employees with physical disabilities.
• If you are a person with disabilities and have specific requirements, please inform us during the application process or at any time during your employment

Let’s unleash your full potential at Persistent - persistent.com/careers

“Persistent is an Equal Opportunity Employer and prohibits discrimination and harassment of any kind.”