Endpoint Engineer, Data Security

Build the endpoint data-protection layer of the Ent agent: classify sensitive data on the device, trace how it is created and moved, and enforce policy at the moment of egress.

Instrument and control the full set of exfiltration channels — removable media and USB, printing, clipboard, drag-and-drop, screen capture, network shares, Bluetooth and AirDrop, email, web and browser upload, sync clients, and AI tools and agents including chat interfaces, IDE assistants, and CLI agents.

Implement on-device content inspection and classification: regular expression and pattern matching, keyword and dictionary matching, exact and indexed document matching, fingerprinting, file-type and structure identification, and OCR for image-borne content.

Integrate Ent's on-device small language model into classification and intent decisions so enforcement reflects what the user is trying to do, not only what a file contains.

Build data lineage and provenance tracking that keeps classification attached to content as it is copied, renamed, transformed, archived, compressed, or re-encoded.

Implement or work with team members to the interception plumbing that makes the above possible: Windows minifilters and ETW, macOS Endpoint Security Framework and Network Extensions, Linux fanotify and eBPF, and browser extension hooks.

Drive precision as a first-class metric: build labeled corpora, measure false-positive and false-negative rates per detector, and tune classification quality with evidence.

Keep inspection cost invisible to the user — budget CPU, memory, and I/O for content scanning, and never block, delay, or corrupt legitimate user files and workflows.

Produce forensically useful incident evidence — who, what data, which channel, what intent — that feeds investigation timelines, insider-risk review, and compliance reporting.

Own customer escalations on missed egress paths, and application-compatibility conflicts, and turn recurring patterns into permanent fixes.

Partner with product, security research, AI, and compliance stakeholders to map endpoint controls to regulatory regimes such as GDPR, HIPAA, PCI DSS, CCPA, and export-control requirements.

5+ years shipping production systems software in C/C++, including work on an endpoint agent deployed at enterprise scale.

Direct experience building or operating an endpoint for insider-risk, data-security, or CASB/SASE data-protection product.

Strong operating system internals knowledge on at least one platform: file system filtering, process and handle interception, and the user/kernel boundary.

Hands-on content inspection and data classification work: pattern-based detection, fingerprinting and hashing schemes, file format parsing, and handling of archives and Office/PDF container formats.

controlling device and network egress channels — USB and removable media, print, clipboard, HTTPS upload.

Multi-threaded, performance-sensitive engineering against measured latency and throughput budgets.

Strong debugging and profiling skills on real user machines, including application-compatibility investigations where the security agent is suspected first.

A precision mindset: you understand that a noisy product gets disabled, and you instrument accordingly.

Clear written and verbal communication with distributed teams and customer-facing stakeholders.

OCR, ML-based classification, or embedding and LLM-based content understanding applied to data protection.

Implementation experience with data lineage or provenance tracking.

Cross-platform development spanning Windows and macOS (Linux a plus), and browser extension development.

Encryption, rights management, or key handling on the endpoint.

Depth in regulatory compliance and audit-evidence design.

Insider-threat investigation workflows, or data governance for AI tools and autonomous agents.

Distributed workplace.

While we have positions we hire for in our SF office, we also hire remotely across North America.

Own a piece of the journey.

Every teammate gets meaningful equity on top of their salary.

We’ve got you covered. 90% of your medical, dental, and vision is paid by Ent.

We also cover 75% for your dependents.

Take the time you need.

Our flexible PTO lets you recharge, travel, or just take a breather.

Family matters. 12 weeks of fully paid maternity leave (birth, adoption, or foster) and 8 weeks fully paid paternity leave.

Live well.

A $100 monthly lifestyle account to spend on what keeps you healthy and happy — fitness, wellness, learning, and more.

Set up your space.

A $500 home office stipend when you join as a remote employee.

We’re committed to building a diverse, inclusive, and equitable workplace where people of all backgrounds, identities, experiences, and abilities are welcomed, valued, and supported.

We recognize there is no single path to success and value nontraditional career journeys and diverse perspectives as key to building stronger, more innovative teams.

We strive to ensure an inclusive experience at every stage of hiring and are happy to provide reasonable accommodations.

If you require accommodations or accessible formats at any point during our process, please let your recruiter know.

As an equal opportunity employer, our hiring process is designed to put you at ease and help you do your best work.

If there’s anything we can do to improve your experience, we’re always open to feedback.