Senior Endpoint Engineer, EDR (macOS)

The role

You will design and ship the macOS agent including the privileged daemon, per-user agents, and system extensions. You will own EDR-class detection and prevention end to end by instrumenting telemetry at the OS boundary and managing multi-process architecture.

What you will do

• Design, build, and ship the macOS agent components
• Own EDR-class detection and prevention capability end to end
• Instrument telemetry at the OS boundary
• Design and maintain the multi-process architecture
• Harden the agent against tamper, bypass, and evasion
• Hold sensor CPU, memory, and I/O inside strict budgets
• Build test harnesses and automated regression coverage
• Drive high-severity customer escalations to root cause
• Partner with security research, AI, platform, and product teams
• Review code, mentor engineers, and document design decisions

Required qualifications

• 10+ years designing, building, and delivering production native systems software (Swift, C, C++, or Objective-C)
• Strong, current Swift including modern concurrency (actors, Sendable, structured concurrency)
• Deep working knowledge of macOS internals: process and thread lifecycle, memory management, file systems, code signing and entitlements, launchd, IPC (XPC and Mach primitives), and the TCC permission
• Hands-on production experience with the Endpoint Security framework and/or Network Extensions
• Understanding of the system extension lifecycle that replaced kernel extensions
• Demonstrated experience building or operating an EDR, EPP, XDR, DLP, or insider-risk product, or equivalent detection-and-response engineering
• Practical fluency in attacker TTPs
• Strong low-level debugging skills: lldb, crash-dump and hang analysis, performance tracing with Instruments or equivalent
• Multi-threaded and concurrent programming under load
• Track record of code running on large fleets
• Scripting fluency for tooling and test automation (Python, shell, or equivalent)
• Clear written and verbal communication

Nice to have

• Reverse engineering, malware analysis, or exploit and vulnerability research background
• Experience shipping on-device ML inference (Core ML, ONNX Runtime, llama.cpp-class runtimes) inside a resource-constrained agent
• Experience with browser extension or native-messaging integrations for telemetry capture
• Cross-platform endpoint agent experience (Windows or Linux sensors) alongside macOS

Benefits

• Meaningful equity on top of salary
• 90% of medical, dental, and vision is paid by Ent
• 75% coverage for dependents for medical, dental, and vision
• Flexible PTO
• 12 weeks of fully paid maternity leave (birth, adoption, or foster)
• 8 weeks fully paid paternity leave
• $100 monthly lifestyle account for fitness, wellness, learning, and more
• $500 home office stipend for remote employees

About the company

Ent is the intent-aware workspace security platform for securing human and AI-driven work. Founded by the co-founders of RiskIQ and the team behind Microsoft Security Copilot, Ent is in production with Global 2000 customers.