Senior Software Engineer (Runtimes)

HeroDevs, Inc.•,

About The Position

HeroDevs is seeking a Senior Software Engineer to join its Never-Ending Support (NES) team, focusing on developing and proving out new product lines in runtimes. The role researches potential products, produces security patches for CVEs in runtime products such as PHP, Postgres, and NGINX, delivers builds across operating system distributions, and develops automation to scale this work. The engineer will assess end-of-life projects and establish supportable build pipelines; maintain the existing NES portfolio by reviewing upstream security fixes and backporting patches; implement security fixes for end-of-life technologies; and build and validate packages across Linux distributions and releases. The role also involves preserving legacy build environments, using AI-assisted automation for security work, building regression test harnesses, and helping customers resolve compatibility issues and plan upgrades. The position is on a small, high-autonomy team and includes taking products from research through launch and communicating with customers and internal stakeholders.

Requirements

Strong understanding of language runtimes and server software internals, such as Node.js, PHP, NGINX, or PostgreSQL.
Ability to read and reason about unfamiliar low-level C and C++ code, including adapting security patches to different code baselines.
Experience reviewing security patches for correctness, memory safety, and unintended side effects.
Deep knowledge of Linux packaging and build tooling, including autotools, CMake, Make, GCC/Clang, RPM and DEB packaging, and distribution build systems such as mock, pbuilder, or abuild.
Experience building and shipping software across multiple Linux distributions and versions, with knowledge of their toolchain, libc, and dependency differences.
Experience with cross-compilation and multiple CPU architectures, including x86_64, aarch64, and armv7.
Experience building and debugging complex software from source, including toolchain and build-system archaeology.
Practical experience using LLMs to automate engineering work, with judgment about when automation is appropriate and trustworthy.
Strong ownership of correctness and quality, including rigorous testing, regression coverage, and awareness of potential patch side effects.
Comfort working in a small, high-autonomy team and helping shape its processes.
Ability to take a new product from research to launch.
Comfort participating in customer support calls to troubleshoot complex integration issues.
Strong communication skills for sharing results and explaining solutions in tier-3 support.

Nice To Haves

Background in security research, vulnerability triage, or product security.
Contributions to open source C/C++ projects, particularly PHP, NGINX, PostgreSQL, Node.js, OpenSSL, or the Linux kernel.
Strong grasp of security fundamentals, including CVEs, CVSS, common C vulnerability classes, and exploitability assessment.
Familiarity with container image hardening, SBOMs, artifact signing, and supply chain security.
Experience as a technical lead or team lead.
Experience running production services on AWS, Azure, and Kubernetes.

Responsibilities

Research and prove out new NES products by evaluating end-of-life codebases, build systems, and CVE histories, then creating working, supportable build pipelines.
Maintain the NES portfolio by analyzing upstream security fixes and backporting CVE patches to end-of-life versions in C, C++, and other languages.
Implement comprehensive or novel security fixes for end-of-life technologies.
Read, write, and review CVE backports, considering potential effects across versions, platforms, and configurations.
Build and deliver packages across Linux distributions, and add support for new distributions and releases.
Restore and maintain legacy build environments, including researching toolchains and pinning dependencies that no longer resolve.
Build and use AI-assisted automation for triage, patch analysis, backport drafting, and regression verification.
Build and maintain test harnesses to validate CVE patch correctness and backwards compatibility.
Support customers' engineering teams with compatibility issues and upgrade paths.
Take new products from research through launch and help shape processes in a small, high-autonomy team.
Participate in support calls with product end users to troubleshoot complex integration issues.
Communicate results during early product iterations and provide solutions in tier-3 support situations.