# Senior Software Engineer – Virtual Network Security Appliance (C++ / Go / Rust) at Securly

> India · Senior · Security · open. Source: https://alderhq.app/jobs/greenhouse%3Asecurly13%3A8187177 (read 2026-11-13).

## Facts (observed)

- Company: [Securly](https://alderhq.app/companies/securly)
- Location text: Pune City, Maharashtra, India; Pune, India
- Where it can be done from (inferred): India (evidence: "Location lists "pune"")
- Posted: 2026-09-08 (66 days ago)
- First seen by alder: 2026-11-07 · last verified: 2026-11-07
- Reposted: 0 times · edited: 0 times
- Apply on the employer's site: https://www.securly.com/job-description?gh_jid=8187177
- Skills listed (inferred): Rust, C++, AWS, Docker, Terraform

## Pay and sponsorship

- Posted pay: not posted
- Market band for similar posted roles (India, n 27): p25 $87k, median $87k, p75 $87k

## Description (the employer's text)

### Senior Software Engineer – Virtual Network Security Appliance (C++ / Go / Rust)

Hybrid – Pune, India · Full-time, direct hire · Rust · C/C++ · Go · Linux networking · Containers · AWS

### The role

You'll build and own Securly's edge proxy appliance: a virtual appliance (containers on a minimal Linux OS image) that we deliver into customers' school networks to intercept, inspect, and filter web traffic. You own it end to end: the traffic-handling datapath, how it's packaged and shipped, how it updates itself safely, how it fails without cutting off a network, and how the deployed fleet reports back to our AWS control plane.

This is a senior role in Pune Engineering, reporting to the SVP of Engineering.

### You'll bring

You've shipped software that runs inside a customer's network, such as a proxy, firewall, secure web gateway, VPN gateway, load balancer, or network security appliance. We're open to strong C/C++ or Go engineers whose Rust is still growing, as well as Rust engineers with appliance or proxy experience.

- 8+ years of software engineering in systems, networking, or security products
- Production experience in Rust, C/C++, or Go. Rust is where the new proxy is headed, so you'll write Rust here.
- Network programming below the HTTP layer: TCP streams, sockets, bidirectional forwarding, transparent proxying (TPROXY), TLS, and the Linux network stack
- A shipped appliance, proxy, or network security product you can name, and the problems you solved on it
- Containerization and software delivery into customer networks: Docker image builds, minimal Linux images, container networking, installs and upgrades
- Network security fundamentals: TLS, mTLS, certificates, and hardening systems against tampering
- Performance testing and profiling: load tests, CPU/memory profiling, flame graphs
- Working knowledge of AWS and infrastructure as code (CloudFormation or Terraform)
Strongly preferred: production Rust (async, Tokio); Linux kernel networking (eBPF/XDP, netfilter, routing); HAProxy or Envoy; OTA or fleet management at scale; high-availability design (watchdogs, VRRP/CARP failover).

Nice to have: RADIUS; fleet messaging (gRPC over mTLS, MQTT, AWS IoT Core); observability (CloudWatch, Splunk, SLO definitions); immutable OS images (Flatcar, Talos, Buildroot).

### What you'll build

- Proxy datapath: TCP interception, transparent proxying, and TLS inspection, plus Linux network stack tuning for throughput and latency.
- Appliance packaging and delivery: Container images and a minimal, immutable OS image that installs and runs cleanly inside customer networks.
- Safe updates: Zero-downtime OTA updates with A/B swaps, automatic health-check rollbacks, and phased canary rollouts to machines you can't log into.
- Fail-open and high availability: Watchdogs, failover, and bypass logic so the customer's internet keeps working if the appliance doesn't.
- Fleet control plane: Secure, low-latency channels for policy updates and telemetry between deployed appliances and AWS.
- Security hardening: Protecting the appliance against tampering and configuration drift in environments we don't own.
- Performance baselines: Load tests that simulate sharp, predictable traffic spikes (everyone on the network coming online at the start of the school day), profiling, and written baselines.
### The technical challenges

- Traffic you have to handle correctly, every time. The proxy sits in the path of all web traffic on the network. Latency, memory use, and correctness under load all matter.
- Machines you can't touch. Appliances run inside networks we don't control. Updates, rollbacks, and debugging all have to work remotely, through telemetry and careful rollout design.
- Failure has to be safe. If the appliance crashes or an update goes wrong, traffic must keep flowing. Designing fail-open behavior and failover is core to the job.
- Every environment is different. Customer networks vary widely in hardware, firewall setups, and configuration. The appliance has to install and run cleanly across all of them.
- Architecture decisions are yours. Many design choices, standards, and documents for the appliance are still to be defined. You'll make those decisions and write them down.

---
Data: alder (https://alderhq.app). Cite https://alderhq.app/jobs/greenhouse%3Asecurly13%3A8187177 and the date you read it. Observed facts come from the employer's own listing; location reach, level, family and skills are inferences.