Lead Endpoint Engineer - Linux

The role

You will design, build, and maintain a production-grade, AI-native DLP agent for Linux. This includes kernel-level event interception, userspace policy enforcement, and enterprise deployment.

What you will do

• Design and develop data exfiltration prevention applications, kernel modules, system services, and agents on Linux.
• Build and maintain mission-critical endpoint agents across Linux distributions.
• Implement kernel-level event interception using eBPF, LSM hooks, netfilter, fanotify, or similar mechanisms.
• Develop userspace components that integrate with kernel subsystems and enforce policy decisions in real time.
• Collaborate with Mac and Windows endpoint teams on cross-platform agent architecture and shared policy models.
• Own complex features from design to delivery including scoping, implementation, testing, and documentation.
• Diagnose and resolve deep systems-level issues like kernel panics, race conditions, and IPC failures.
• Ensure agent reliability, upgrade safety, and minimal performance footprint.
• Write and maintain documentation for internal architecture, public APIs, and deployment guides.

Required qualifications

• Expertise in C/C++ for Linux systems development
• Demonstrable experience building production agents or system-level software on Linux
• Deep hands-on experience with one or more Linux kernel subsystems relevant to security and monitoring
• Practical knowledge of eBPF (including BPF CO-RE, libbpf, and BCC)
• Experience with Linux Security Modules (LSM) - SELinux, AppArmor, or custom LSM hooks
• Working knowledge of fanotify, inotify, netlink, and procfs
• Familiarity with Linux namespaces, cgroups, and container runtimes (Docker, containerd)
• Experience with kernel-level debugging using tools such as ftrace, perf, crash, SystemTap, or GDB with KGDB
• Ability to use reverse engineering and binary analysis techniques
• Familiarity with enterprise Linux deployment environments - MDM tools
• Ability to decompose complex business problems and own them end to end
• 10+ years of related systems/endpoint engineering experience

Nice to have

• Familiarity with Go is a strong plus
• Prior experience building DLP, EDR, or endpoint security products on Linux
• Contributions to open-source Linux kernel or eBPF ecosystem projects
• Experience with FUSE (Filesystem in Userspace) or overlayfs
• Knowledge of Linux audit subsystem (auditd) and its integration with SIEM tooling
• Experience developing or integrating with XDR/EDR platforms (CrowdStrike, SentinelOne, or similar)
• Familiarity with clipboard and X11/Wayland display server internals

About the company

Nightfall is an AI-native, unified data loss prevention and insider risk management platform. It protects sensitive data across SaaS apps, GenAI tools, email, and endpoint devices.