Senior Endpoint Engineer, EDR (linux)

The role

This role builds detection and prevention on eBPF, LSM, and the audit subsystem for the Linux sensor. You will design and ship kernel- and user-mode components of the Ent agent to turn activity into intent signals.

What you will do

• Design, build, and ship kernel- and user-mode components of the Ent agent
• Own EDR-class detection and prevention capability end to end
• Make and defend tradeoffs between detection efficacy, false-positive rate, and endpoint performance
• Instrument telemetry at the OS boundary using eBPF, LSM, and audit subsystems
• Harden the agent against tamper, bypass, and evasion
• Hold sensor CPU, memory, and I/O inside strict budgets
• Build test harnesses and automated regression coverage
• Drive high-severity customer escalations to root cause
• Partner with security research, AI, platform, and product teams
• Review code, mentor engineers, document design decisions, and share on-call

Required qualifications

• 10+ years designing, building, and delivering production C/C++ (or Rust) systems software
• Deep working knowledge of operating system internals: process and thread lifecycle, memory management, file systems, drivers or kernel extensions, and IPC
• Hands-on production experience with eBPF
• Demonstrated experience building or operating an EDR, EPP, XDR, or AV product, or equivalent detection-and-response engineering
• Practical fluency in attacker TTPs
• Strong low-level debugging skills, performance tracing, and crash-dump analysis
• Multi-threaded and concurrent programming under load
• Track record of code running on large fleets without degrading end-user experience
• Scripting fluency for tooling and test automation (Python or equivalent)
• Clear written and verbal communication with distributed teams and customers

Nice to have

• Kernel-mode driver or kernel extension development shipped to production at scale
• Reverse engineering, malware analysis, or exploit and vulnerability research background
• Experience with anti-tamper and code integrity

Benefits

• Meaningful equity on top of salary
• 90% of medical, dental, and vision is paid by Ent
• 75% coverage for dependents for medical, dental, and vision
• Flexible PTO
• 12 weeks of fully paid maternity leave
• 8 weeks fully paid paternity leave
• $100 monthly lifestyle account for fitness, wellness, learning, and more
• $500 home office stipend for remote employees

About the company

Ent is the intent-aware workspace security platform for securing human and AI-driven work. Founded by the co-founders of RiskIQ and the team behind Microsoft Security Copilot, Ent is in production with Global 2000 customers.