Suricata Developer

Job Description: Suricata Developer (Cybersecurity Platform) About the Team SecurITe’s mission is to build an Agentic-AI driven security platform that protects critical infrastructure from modern cyber threats. Our focus is on delivering highly performant, resilient, and intelligent network security systems that help defenders stay ahead of adversaries. About the Role We’re looking for a specialized Suricata Developer / Network Security Engine Engineer to drive the core packet processing, deep packet inspection (DPI), and threat detection engine powering our cybersecurity AI platform. As a Suricata Developer, you will design, customize, and extend the Suricata IDS/IPS/NSM engine, write custom detection modules, optimize packet capture pipelines, and integrate real-time network telemetry with our agentic AI platform. You will work at the interface of low-level C/Rust systems programming, network protocol analysis, high-throughput packet processing, and threat intelligence. You’ll collaborate closely with AI/ML Engineers, Threat Researchers, Systems Engineers, and Backend Developers to create high-throughput, low-latency detection systems capable of analyzing multi-gigabit network traffic streams without packet loss. This role is ideal for C/Rust systems engineers and network security specialists who are passionate about open-source security tools, packet inspection internals, kernel bypass networking, and high-performance detection systems. Why This Role Matters Network visibility and real-time detection form the bedrock of cybersecurity defense. Suricata is the engine that transforms raw network packets into structured threat intelligence. As our Suricata Developer, you will build and tune the foundational layer that feeds high-fidelity network context into our Agentic AI models. Your contributions will directly power the detection of zero-day exploits, lateral movement, and advanced threat techniques across enterprise cloud and on-premise networks. You’ll solve ultra-low-latency engineering challenges involving high-throughput traffic, custom rule engine extensions, and custom output event pipelines. What You’ll Do Architect, extend, and optimize custom builds of the Suricata engine for high-throughput enterprise deployments Develop native C/Rust custom keywords, plugins, output modules, and protocol parsers within the Suricata codebase Optimize network packet capture and processing pipelines utilizing AF_PACKET, DPDK, PF_RING, or eBPF/XDP Integrate Suricata event outputs (EVE JSON, PCAP, metadata) seamlessly with real-time streaming architectures and AI detection models Benchmark engine performance, tune multi-threading/cpu-pinning options, and eliminate memory and latency bottlenecks under heavy traffic loads Write and validate custom detection signature sets, Lua detection scripts, and dynamic detection rule logic for complex protocols Contribute to and collaborate with the open-source Suricata community while advancing SecurITe's proprietary platform capabilities Impact You’ll Have Enable real-time, zero-packet-loss threat inspection across high-speed enterprise networks (10G/40G/100G pipelines) Provide deep protocol visibility and rich contextual telemetry to feed downstream Agentic-AI analysis Significantly lower memory overhead and processing latency of network inspection nodes Expand detection capabilities for proprietary, industrial, or emerging network protocols Strengthen the platform's ability to identify and neutralize evasive cyber threats in real time Required Experience 3+ years of professional experience developing or extending network security tools (Suricata, Snort, Zeek/Bro, Wireshark) Strong C and/or Rust programming experience in a Linux environment Deep understanding of Network Security Monitoring (NSM), Intrusion Detection Systems (IDS), and Intrusion Prevention Systems (IPS) Hands-on expertise with Suricata internals (code architecture, flow engine, rule parser, output formatters, threading models) In-depth understanding of TCP/IP stack, network protocols (HTTP/2, TLS/SSL, DNS, SMB, gRPC), and packet analysis using PCAP/Wireshark Experience optimizing packet capture and kernel bypass technologies (AF_PACKET, eBPF/XDP, DPDK, or PF_RING) Required Skills & Qualifications Expert-level C/Rust systems programming skills with attention to memory safety and performance optimization Strong knowledge of Linux network stack, socket programming, and multi-threaded performance tuning Experience developing custom Lua scripts and signature rules for Suricata / Snort Familiarity with JSON parsing, streaming data pipelines (Kafka, ZeroMQ), and logging frameworks Experience with Linux administration, GCC/Clang toolchains, GDB debugging, and Valgrind profiling Excellent analytical, debugging, and software design skills Strong collaborative mindset and ability to work effectively in fast-moving startup environments Nice to Have Active contributions to open-source network security projects (OISF/Suricata, Zeek, Libpcap) Experience with eBPF, XDP, or kernel-level packet filtering technologies Knowledge of malware traffic analysis, threat hunting, and MITRE ATT&CK framework mapping Experience developing custom protocol dissectors or parsers (e.g., ICS/SCADA protocols like Modbus, DNP3) The Mindset Performance Obsessed You measure performance in microseconds and benchmark every line of code to eliminate overhead. Protocol Whisperer You enjoy dissecting complex network RFCs and inspecting hex dumps to understand exact traffic behavior. Ownership-Driven You take end-to-end responsibility for packet capture quality, detection accuracy, and engine stability. Startup DNA You thrive on fast-paced innovation, building robust production-ready tools with agility.