Endpoint Engineer, EDR (linux)

Design, build, and ship kernel- and user-mode components of the Ent agent that observe process, file, registry, network, and identity activity for Linux and turn that activity into high-fidelity intent signals.

Own EDR-class detection and prevention capability end to end: sensor instrumentation, event enrichment, on-box correlation, and interception logic that stops malicious activity before it completes.

Make and defend explicit tradeoffs between detection efficacy, false-positive rate, and endpoint performance, backed by measured data rather than intuition.

Instrument telemetry at the OS boundary: eBPF, LSM, and audit subsystems.

Harden the agent against tamper, bypass, and evasion — self-protection, integrity validation, and safe handling of untrusted input inside a privileged process.

Hold sensor CPU, memory, and I/O inside strict budgets while processing thousands of events per second; profile hot paths and eliminate regressions before they ship.

Build test harnesses, automated regression coverage so every efficacy claim is continuously verified, not asserted.

Drive high-severity customer escalations to root cause — crashes, hangs, performance regressions, missed detections — at the code and OS-internals level, and convert escalation patterns into permanent fixes.

Partner with the security research, AI, platform, and product teams to feed sensor signals into intent-aware policy enforcement, just-in-time interventions, and investigation timelines.

Review code, mentor engineers, document design decisions, and share ownership of agent release quality and on-call.

10+ years designing, building, and delivering production C/C++ (or Rust) systems software, a substantial portion of it in endpoint security, OS internals, or comparable performance-critical native code.

Deep working knowledge of operating system internals: process and thread lifecycle, memory management, file systems, drivers or kernel extensions, and IPC.

Hands-on production experience with eBPF.

Demonstrated experience building or operating an EDR, EPP, XDR, or AV product, or equivalent detection-and-response engineering.

Practical fluency in attacker TTPs; you can reason about what an attack looks like in raw telemetry, not just in a written report.

Strong low-level debugging skills, performance tracing, and crash-dump analysis.

Multi-threaded and concurrent programming under load — synchronization, lock contention, race conditions, and object lifetime management.

A track record of code running on large fleets without degrading end-user experience; you treat stability and performance as product features.

Scripting fluency for tooling and test automation (Python or equivalent).

Clear written and verbal communication with distributed teams and, when escalations demand it, directly with customers.

Kernel-mode driver or kernel extension development shipped to production at scale.

Reverse engineering, malware analysis, or exploit and vulnerability research background.

with anti-tamper and code integrity.

Distributed workplace.

While we have positions we hire for in our SF office, we also hire remotely across North America.

Own a piece of the journey.

Every teammate gets meaningful equity on top of their salary.

We’ve got you covered. 90% of your medical, dental, and vision is paid by Ent.

We also cover 75% for your dependents.

Take the time you need.

Our flexible PTO lets you recharge, travel, or just take a breather.

Family matters. 12 weeks of fully paid maternity leave (birth, adoption, or foster) and 8 weeks fully paid paternity leave.

Live well.

A $100 monthly lifestyle account to spend on what keeps you healthy and happy — fitness, wellness, learning, and more.

Set up your space.

A $500 home office stipend when you join as a remote employee.

We’re committed to building a diverse, inclusive, and equitable workplace where people of all backgrounds, identities, experiences, and abilities are welcomed, valued, and supported.

We recognize there is no single path to success and value nontraditional career journeys and diverse perspectives as key to building stronger, more innovative teams.

We strive to ensure an inclusive experience at every stage of hiring and are happy to provide reasonable accommodations.

If you require accommodations or accessible formats at any point during our process, please let your recruiter know.

As an equal opportunity employer, our hiring process is designed to put you at ease and help you do your best work.

If there’s anything we can do to improve your experience, we’re always open to feedback.