Suricata Developer

Job Description: Suricata Developer (Cybersecurity Platform)
About the Team
SecurITe’s mission is to build an Agentic-AI driven security platform that protects critical infrastructure from modern cyber threats. Our focus is on delivering highly performant, resilient, and intelligent network security systems that help defenders stay ahead of adversaries.

About the Role
We’re looking for a specialized Suricata Developer / Network Security Engine Engineer to drive the core packet processing, deep packet inspection (DPI), and threat detection engine powering our cybersecurity AI platform.
As a Suricata Developer, you will design, customize, and extend the Suricata IDS/IPS/NSM engine, write custom detection modules, optimize packet capture pipelines, and integrate real-time network telemetry with our agentic AI platform. You will work at the interface of low-level C/Rust systems programming, network protocol analysis, high-throughput packet processing, and threat intelligence.
You’ll collaborate closely with AI/ML Engineers, Threat Researchers, Systems Engineers, and Backend Developers to create high-throughput, low-latency detection systems capable of analyzing multi-gigabit network traffic streams without packet loss.
This role is ideal for C/Rust systems engineers and network security specialists who are passionate about open-source security tools, packet inspection internals, kernel bypass networking, and high-performance detection systems.

Why This Role Matters
Network visibility and real-time detection form the bedrock of cybersecurity defense. Suricata is the engine that transforms raw network packets into structured threat intelligence. As our Suricata Developer, you will build and tune the foundational layer that feeds high-fidelity network context into our Agentic AI models.
Your contributions will directly power the detection of zero-day exploits, lateral movement, and advanced threat techniques across enterprise cloud and on-premise networks. You’ll solve ultra-low-latency engineering challenges involving high-throughput traffic, custom rule engine extensions, and custom output event pipelines.

What You’ll Do
Architect, extend, and optimize custom builds of the Suricata engine for high-throughput enterprise deployments
Develop native C/Rust custom keywords, plugins, output modules, and protocol parsers within the Suricata codebase
Optimize network packet capture and processing pipelines utilizing AFPACKET, DPDK, PFRING, or eBPF/XDP
Integrate Suricata event outputs (EVE JSON, PCAP, metadata) seamlessly with real-time streaming architectures and AI detection models
Benchmark engine performance, tune multi-threading/cpu-pinning options, and eliminate memory and latency bottlenecks under heavy traffic loads
Write and validate custom detection signature sets, Lua detection scripts, and dynamic detection rule logic for complex protocols
Contribute to and collaborate with the open-source Suricata community while advancing SecurITe's proprietary platform capabilities

Impact You’ll Have
Enable real-time, zero-packet-loss threat inspection across high-speed enterprise networks (10G/40G/100G pipelines)
Provide deep protocol visibility and rich contextual telemetry to feed downstream Agentic-AI analysis
Significantly lower memory overhead and processing latency of network inspection nodes
Expand detection capabilities for proprietary, industrial, or emerging network protocols
Strengthen the platform's ability to identify and neutralize evasive cyber threats in real time

Required Experience
3+ years of professional experience developing or extending network security tools (Suricata, Snort, Zeek/Bro, Wireshark)
Strong C and/or Rust programming experience in a Linux environment
Deep understanding of Network Security Monitoring (NSM), Intrusion Detection Systems (IDS), and Intrusion Prevention Systems (IPS)
Hands-on expertise with Suricata internals (code architecture, flow engine, rule parser, output formatters, threading models)
In-depth understanding of TCP/IP stack, network protocols (HTTP/2, TLS/SSL, DNS, SMB, gRPC), and packet analysis using PCAP/Wireshark
Experience optimizing packet capture and kernel bypass technologies (AFPACKET, eBPF/XDP, DPDK, or PFRING)

Required Skills & Qualifications
Expert-level C/Rust systems programming skills with attention to memory safety and performance optimization
Strong knowledge of Linux network stack, socket programming, and multi-threaded performance tuning
Experience developing custom Lua scripts and signature rules for Suricata / Snort
Familiarity with JSON parsing, streaming data pipelines (Kafka, ZeroMQ), and logging frameworks
Experience with Linux administration, GCC/Clang toolchains, GDB debugging, and Valgrind profiling
Excellent analytical, debugging, and software design skills
Strong collaborative mindset and ability to work effectively in fast-moving startup environments

Nice to Have
Active contributions to open-source network security projects (OISF/Suricata, Zeek, Libpcap)
Experience with eBPF, XDP, or kernel-level packet filtering technologies
Knowledge of malware traffic analysis, threat hunting, and MITRE ATT&CK framework mapping
Experience developing custom protocol dissectors or parsers (e.g., ICS/SCADA protocols like Modbus, DNP3)

The Mindset
Performance Obsessed
You measure performance in microseconds and benchmark every line of code to eliminate overhead.
Protocol Whisperer
You enjoy dissecting complex network RFCs and inspecting hex dumps to understand exact traffic behavior.
Ownership-Driven
You take end-to-end responsibility for packet capture quality, detection accuracy, and engine stability.
Startup DNA
You thrive on fast-paced innovation, building robust production-ready tools with agility.