Network Security Developer

Also known as: Network Security Engineer, Network Security Software Engineer, Firewall Developer, Data Plane Engineer, Security Software Engineer.

What does a Network Security Developer do?

A Network Security Developer is a developer who builds network security products: firewalls, IDS/IPS, VPN and traffic analysis, close to the networking stack. The code is mostly C, C++, Go or Rust and works at system level: the Linux networking stack, kernel modules, eBPF, DPDK, packet parsing at line rate:

• develop mechanisms for filtering, inspecting and encrypting traffic;
• write packet processing that doesn't slow the network down under heavy load;
• implement attack detection rules and signatures and DDoS protection;
• profile and optimise performance: throughput, latency, number of connections;
• fix vulnerabilities in their own code and study new attack techniques.

When does a company need a Network Security Developer?

A company needs a Network Security Developer when a network security tool is its product or an important part of it: a security vendor, a network equipment maker, a CDN, a DDoS protection service, a cloud platform or a telecom operator with in-house development. Common triggers: a new product line, a move to a new packet-processing architecture, traffic growth the current solution can't handle. The role won't work if the company needs to configure and maintain off-the-shelf security tools: then it needs a Network Engineer or a DevSecOps Engineer.

Network Security Developer vs Network Engineer: what's the difference?

A Network Security Developer differs from a Network Engineer in building products that protect networks, while a Network Engineer designs and configures networks using ready-made hardware and software. A Network Engineer knows how a product should behave in the network; a Network Security Developer knows how it works inside and why it is fast. An Information Security Analyst uses such tools to find and investigate attacks.

Why is it hard to hire a Network Security Developer?

A Network Security Developer is hard to hire because you need a systems programmer who also deeply understands both networks and security.

• Experience of low-level packet processing at high speeds belongs to a small number of developers, mostly at vendors and in telecom.
• Many strong candidates know networks but not security, or know security but don't write kernel-level code.
• Codebases are often old and written in C/C++, and not every developer is willing to work with them.
• There are few employers, and strong specialists stay at one company for years.

What to decide before hiring a Network Security Developer?

• What exactly do you build: a firewall, IDS/IPS, VPN, DDoS protection, traffic analysis? Experience in one product class transfers to another only partly.
• Which level: kernel and packet processing, or management, interfaces and integrations? These are two different profiles, and mixing them up is a common reason for a failed hire.
• What performance do you need? Throughput and latency requirements decide whether you need experience with DPDK, eBPF or hardware acceleration.
• Which platform and codebase will they work in? A candidate with Go experience may not want to dig into a large old C codebase.

Where to find a Network Security Developer?

Network Security Developers most often come from security vendors, network equipment makers, telecom operators, CDNs, DDoS protection services and cloud platforms; some come from embedded and systems programming. A strong signal in a profile is a product that real traffic passes through, and commits to the Linux kernel or networking open-source projects. Another signal is published vulnerability research or talks on packet-processing performance. NEWHR finds these candidates by the results of their work, not by applications to job posts.

How to assess a Network Security Developer in an interview?

A Network Security Developer is assessed with a walkthrough of a network component the candidate built, an in-depth technical interview and a C/C++ or Go task close to your product. The task usually involves packet parsing, filtering or a performance problem. On the company side the Head of Engineering takes part, along with the Lead Engineer responsible for the kernel or packet processing.

Strong signals:

• explains a packet's path through the kernel and where exactly performance is lost;
• describes how they reached the required throughput, with before and after numbers;
• raises the security of their own code unprompted, for example handling malformed packets.

Red flags:

• knows networks only as an administrator, with no development experience;
• can't discuss memory management and concurrency at the required depth;
• doesn't think about how an attacker could exploit their code.

How long does it take to hire a Network Security Developer?

We present the first candidates for the Network Security Developer role within 5–7 days of the brief.

Related roles

• Information Security Analyst — uses security tools to find and investigate attacks.
• DevSecOps Engineer — builds security into the company's development and infrastructure.
• CISO — owns the company's security strategy rather than product development.
• SRE — owns infrastructure reliability, not a network security product.