Endpoint Engineer, EDR – Linux

This is a fully remote position, open to applicants in North America.

📋 Description

• Take ownership of the Linux sensor that underpins Ent's EDR capabilities.

• Design, develop, and deploy both kernel and user-mode components of the Ent agent.

• Monitor process, file, registry, network, and identity activities on Linux, transforming them into high-fidelity intent signals.

• Manage end-to-end EDR-class detection and prevention, including sensor instrumentation, event enrichment, on-box correlation, and interception logic.

• Make informed trade-offs between detection efficacy, false-positive rates, and endpoint performance based on empirical data.

• Implement telemetry at the OS boundary utilizing eBPF, LSM, and audit subsystems.

• Strengthen the agent against tampering, bypassing, and evasion attempts.

• Adhere to strict CPU, memory, and I/O budgets while processing thousands of events per second.

• Analyze performance hotspots and eliminate regressions.

• Create test harnesses and establish automated regression testing coverage.

• Lead high-severity customer escalations to identify root causes and transform patterns into lasting solutions.

• Collaborate with security research, AI, platform, and product teams on policy enforcement, interventions, and investigation timelines.

• Review code, mentor engineering staff, document design decisions, and share responsibility for the quality of agent releases and on-call duties.

⛳️ Requirements

• Over 10 years of experience in designing, building, and delivering production C/C++ or Rust systems software.

• Significant experience in endpoint security, OS internals, or similarly performance-critical native code.

• In-depth understanding of operating system internals, including process and thread lifecycles, memory management, file systems, drivers or kernel extensions, and IPC.

• Practical experience with eBPF in production environments.

• Background in building or operating EDR, EPP, XDR, or AV products, or equivalent detection-and-response engineering.

• Proficient understanding of attacker TTPs.

• Strong skills in low-level debugging, performance tracing, and crash-dump analysis.

• Experience with multithreaded and concurrent programming under load, including synchronization, lock contention, race conditions, and object lifecycle management.

• Proven track record of deploying code across large fleets without negatively impacting end-user experience.

• Fluency in scripting for tooling and test automation, such as Python or comparable languages.

• Excellent written and verbal communication skills, particularly with distributed teams and customers.

• Experience in kernel-mode driver or kernel extension development that has been shipped to production at scale (bonus).

• Background in reverse engineering, malware analysis, or exploit and vulnerability research (bonus).

• Familiarity with anti-tamper and code integrity measures (bonus).

🏝️ Benefits

• Meaningful equity in addition to salary.

• 90% of medical, dental, and vision premiums covered by Ent.

• 75% coverage for dependents.

• Flexible paid time off (PTO).

• 12 weeks of fully paid maternity leave (for birth, adoption, or foster care).

• 8 weeks of fully paid paternity leave.

• $100 monthly lifestyle account for fitness, wellness, learning, and more.

• $500 home office stipend for remote employees.

• A distributed workplace allowing for remote work across North America.