Senior C++ Engineer, Digital Forensics Engine

PieCyfer; Lahore; Vor Ort; PKR 1.800.000 - 3.400.000; Vollzeit

Zusammenfassung

PieCyfer is seeking an experienced C++ engineer to own the native engine at the center of our forensic examination software on Windows. You’ll work on filesystem, evidence image and container parsers, ensuring compatibility with two decades of formats and cross-examination reliability.

You’ll tackle format archaeology, fix artifacts, and maintain a large codebase with MSVC, Win32, and both C++ and C# projects. If you value careful debugging across module boundaries, this role is for you.

Qualifikationen

• 8+ years of C++ on Windows with MSVC
• Deep Win32 systems programming: IOCTLs, memory-mapped files, threading
• Experience writing readers for undocumented binary formats
• Comfort debugging across module boundaries: heap corruption, CRT mismatches
• MSBuild across vcxproj, vcproj and dsp formats
• Practical ownership in a codebase with thin test coverage

Aufgaben

• Own the plugin platform behind 40+ parser families and a stable C ABI
• Diagnose and fix format-level defects from real casework
• Maintain a large build consisting of many C++ and C# projects
• Reduce risk in an aging dependency stack without changing shipped behavior
• Collaborate to ensure long-lived, reliable system behavior

Kenntnisse

C++ on Windows

Win32 systems programming

Binary format parsing

Debugger across modules

MSBuild usage

Tools

MSBuild

Visual Studio

Git

Jobbeschreibung

1 open positions

About the role

We build forensic examination software used by law enforcement, government and corporate incident response teams. Examiners use it to acquire drives and mobile devices, recover deleted data, parse two decades of application artifacts and produce evidence that holds up in court.

You’ll own the native C++ engine at the center of the product: the filesystem, evidence image and container parsers, and the plugin platform that hosts them. Most of the work is format archaeology. A customer has an unusual or partly corrupted artifact, and the parser has to get evidence out of it that survives cross-examination. Correctness matters more than cleverness here, and no change can break 20 years of supported formats.

What you’ll work on

• Owning the plugin platform behind about 40 parser families: a stable C ABI, an object model passed across DLL boundaries, and remote execution of parsers over our in-house RPC layer
• Diagnosing and fixing format-level defects reported from real casework, including partly overwritten, compressed and corrupted evidence
• Keeping a large build healthy: 437 C++ and 166 C# projects, Win32 and x64, several product editions from one source tree
• Reducing risk in an aging dependency stack (legacy toolchain, duplicated crypto libraries, third-party code vendored by hand) without changing shipped behavior

What you need

• 8+ years of C++ on Windows with MSVC, much of it in pre-C++11 codebases
• Deep Win32 systems programming: device and volume IOCTLs, memory-mapped files, threading, registry, sockets
• Experience writing readers for undocumented binary formats, from a spec or by reverse engineering
• Comfort debugging across module boundaries: heap corruption, CRT mismatches, loader issues, mixed native and managed crashes
• MSBuild across vcxproj, vcproj and dsp project formats
• Practical ownership in a codebase where test coverage is thin and regression risk is high

What will set you apart

• Prior work on forensic or e-discovery products: disk imaging, file carving, mail store parsing, indexing
• Filesystem internals down to MFT data runs, attribute lists, journaling and slack space recovery
• SQLite and LevelDB at the file format level, especially running queries over partial or reconstructed data
• Applied cryptography beyond API calls (Crypto++, OpenSSL, CNG)
• Mobile acquisition: iOS backups, ADB, chip-level flashing
• Bison/Flex or other parser generators, full-text search engines (Lucene/CLucene), OCR pipelines

Our stack, honestly

C++ on Visual Studio 2015 with Win32 and x64 output. C# WinForms on .NET Framework 2.0 to 4.6.1. Firebird embedded for case storage, SQLite/SQLCipher and LevelDB, CLucene for indexing. An in-house RPC layer over TCP and named pipes, plus one gRPC service. WiX installers. Third-party libraries are checked into the repo by hand rather than pulled from a package feed.

We maintain long-lived legacy code on purpose. If you only enjoy greenfield work, this role isn’t for you. If you like making old, important systems more reliable, it probably is.

You don’t need a forensics background

We welcome engineers from adjacent fields: backup and imaging products, database engines, antivirus and EDR format parsing, malware reverse engineering, and DFIR practitioners moving into engineering.