Engineering Manager, Endpoint Security Platform

KestrelSec India Private Limited; Gurugram District; Presencial; INR 1.800.000 - 3.200.000; Jornada completa

Descripción de la vacante

KestrelSec India Private Limited in Gurugram invites an experienced senior security platform leader to own people, delivery and lifecycle of a unified endpoint security platform across Windows, macOS, Linux, mobile and cloud workloads.

You will build and lead high-performing engineering teams, run the platform as a reliable service, and ensure every agent and content update reaches customers safely through staged rollouts, strong SRE practices and proactive incident management.

Formación

• 8–10 years in software product development, with at least 6 years in cybersecurity.
• 4+ years managing engineering teams, including managers or tech leads, overseeing 10+ engineers.
• Experience owning production operations: on-call, SLOs and incident leadership.
• Experience with threat modeling, secure SDLC, and compliance awareness.

Responsabilidades

• Lead a multi-team organization including first-line managers and senior staff.
• Plan headcount, capacity and hiring end-to-end, sourcing scarce skills.
• Define agent framework and move to user-mode security frameworks.
• Map capabilities to MITRE ATT&CK and conduct red-team testing.
• Define SLOs/SLIs for cloud platform and agent fleet; ensure observability.
• Engage customers and executives during incidents and postmortems.

Conocimientos

People leadership

Engineering management

Architecture and technical oversight

Cloud backend / multi-tenant systems

Security product development

Educación

B.E./B.Tech/M.Tech/MS in Computer Science or related field

Herramientas

AWS/Azure/GCP

Kubernetes

REST/gRPC

CI/CD

Descripción del empleo

You will own the people, delivery and full lifecycle of a unified endpoint security platform: from roadmap and build, through safe release and operations, to support and end-of-life. The platform protects Windows, macOS, Linux, mobile, servers, virtual desktops, cloud workloads, containers and IoT/OT devices. It spans prevention (EPP), detection and response (EDR/XDR), and posture and compliance management, at a scale of millions of endpoints.

You will build and lead high-performing engineering teams, run the platform as a reliable service, and make sure every agent and content update reaches customers safely.

Key Responsibilities:

A. People leadership and organization

• Lead, coach and grow a multi-team organization, including first-line managers and senior technical staff.
• Run performance management: goals, regular one-on-ones, reviews, promotions, career ladders, and addressing underperformance.
• Design the org structure and team boundaries (agent, cloud backend, console, data pipeline, QA, SRE) and plan headcount and capacity.
• Own hiring end to end: interview loops, hiring bar, sourcing scarce skills (kernel, eBPF, macOS internals), and onboarding.
• Build an inclusive, accountable culture that works across sites and time zones; track engagement and retention.
• Own the end-to-end lifecycle of agents, cloud services and console: roadmap, build, release, support, deprecation and end-of-life.
• Run separate release pipelines for agent code and detection content (signatures, rules, models), each with its own validation gates.
• Implement staged rollouts: canary and ring deployments, feature flags, kill switches, automatic rollback, and customer-controlled update channels (N, N-1, N-2).
• Define the agent version support matrix, long-term support (LTS) releases, and deprecation and EOL policies, while keeping APIs and policies backward compatible.
• Deliver day-zero support for new Windows, macOS, Linux kernel and distribution releases through beta OS programs.
• Plan customer migrations between platform versions, editions or acquired products.

C. Architecture and technical oversight

• Partner with principal engineers and architects on the end-to-end platform design: agent/sensor, multi-tenant cloud backend, management console, APIs and data pipeline.
• Run architecture and design reviews; make and document build-vs-buy-vs-partner decisions.
• Keep the agent framework modular (AV, EDR, firewall, device control, DLP, application control) with minimal CPU, memory and I/O footprint.
• Lead the move of kernel-dependent capabilities toward user-mode frameworks as OS vendors restrict kernel access (for example, the Windows endpoint security platform), without losing visibility or tamper resistance.

D. Detection, prevention, response and AI

• Work with threat researchers and detection engineers to deliver behavioral detection, exploit prevention, ransomware protection and rollback, fileless malware defense and memory protection.
• Deliver GenAI features such as investigation copilots, natural-language threat hunting and agentic SOC workflows, with clear guardrails and evaluation.
• Extend protection to AI tools on the endpoint, such as local AI agents and MCP servers that employees run.
• Build response actions: host isolation, process kill, quarantine, remote shell, live forensics and automated playbooks.
• Map capabilities to MITRE ATT&CK and validate them through red-team and adversary-emulation testing.

E. Telemetry, data and analytics

• Deliver high-throughput ingestion and stream processing (Kafka or similar) and a security data lake for hunting and analytics.
• Manage telemetry cost: tiering, retention, sampling and cost per protected endpoint.
• Build privacy into the pipeline: data minimization, PII pseudonymization, regional data residency and per-tenant retention.

F. Management console, APIs and integrations

• Deliver centralized policy management, role-based access control, fleet visibility and compliance dashboards.
• Provide documented REST/GraphQL APIs and integrations with SIEM, SOAR, ITSM, IAM, MDM and vulnerability management tools.
• Support SaaS, private cloud, on-prem and air-gapped deployments, plus enterprise rollout tooling (Intune, SCCM, Jamf, Ansible) and VDI optimization.

G. Reliability, operations and incident management

• Define SLOs and SLIs for the cloud platform and agent fleet; build observability and fleet health monitoring.
• Own on-call design, incident response, blameless postmortems and follow-up actions.
• Lead major incidents, including communication with customers, executives, Legal and PR.
• Plan capacity, disaster recovery and multi-region failover.
• Build large-scale quality engineering: an OS and device compatibility lab, performance benchmarking, chaos and fault-injection testing, soak testing, and false-positive testing against known-good software before each release.

H. Product security, compliance and regulation

• Embed secure SDLC: threat modeling, SAST/DAST, fuzzing, dependency and supply-chain security, SBOM, reproducible builds and code signing.
• Run a product security incident response team (PSIRT): coordinated vulnerability disclosure, bug bounty, CVEs and security advisories for the product itself.
• Meet regulatory reporting duties, including the EU Cyber Resilience Act (24-hour reporting of actively exploited vulnerabilities from September 2026; full obligations and CE marking from December 2027), NIS2, DORA (for financial-sector customers), CERT-In incident reporting and the India DPDP Act.
• Drive certifications such as ISO 27001, SOC 2, Common Criteria, FedRAMP, FIPS 140-3 and GDPR/data residency, as applicable.
• Plan post-quantum cryptography migration for agent-to-cloud communication and code signing.
• Support independent testing: AV-Test, AV-Comparatives, MITRE ATT&CK evaluations, and Gartner/Forrester assessments.

I. Business, budget and stakeholder management

• Own the engineering budget: headcount, cloud spend, tools, licences, vendors and contractors.
• Partner with Product Management on roadmap, packaging, editions and prioritization; contribute to pricing and P&L discussions.
• Track the competitive landscape and feed it into roadmap decisions.
• Lead technical due diligence and integration for acquisitions.
• Ensure open-source licence compliance, including GPL considerations for Linux kernel modules and eBPF.
• Engage key customers and partners on architecture reviews, escalations and feedback; represent engineering to executives.

Required qualifications

• Education: B.E./B.Tech/M.Tech/MS in Computer Science, Information Security, Electronics or a related field. An MBA or management training is a plus.

Experience:

• 8-10 years in software product development, with at least 6 years in cybersecurity (endpoint security strongly preferred).
• At least 4 years managing engineering teams, including managing other managers or tech leads, and 10+ engineers at once.
• At least 3 years of prior hands-on engineering or architecture work on systems, security or distributed cloud software.
• A proven record of shipping and operating enterprise security products at scale, including at least one full release lifecycle from launch to end-of-life.
• Experience owning production operations: on-call, SLOs and leading major incidents.

Leadership and management skills

• Hiring, coaching, performance management and building manager and tech-lead pipelines.
• Delivery management: planning, estimation, risk management and predictable releases (Agile/Scrum, SAFe or similar).
• Budget, vendor and capacity planning.
• Clear written and verbal communication with executives, customers, regulators and engineers, especially during incidents.
• Sound judgment under ambiguity when balancing security efficacy, stability, performance, cost and time-to-market.

Technical skills

• Languages: C/C++ (agent and kernel work), Rust, Go, Python; Java/Kotlin for backend and Android; Swift/Objective-C for macOS/iOS
• OS internals: Windows internals and the move to user-mode security frameworks, Linux kernel/eBPF, macOS security frameworks, mobile OS security models
• Security domains: EPP, EDR, XDR, ITDR, anti-malware, exploit prevention, application and device control, host firewall, DLP, disk encryption, patch and vulnerability management
• Release and lifecycle: Ring/canary deployment, feature flags, rollback, LTS and version support matrices, deprecation and EOL management
• Cloud and backend: AWS/Azure/GCP, microservices, Kubernetes, Kafka, Elasticsearch/OpenSearch, ClickHouse or similar, multi-tenant distributed systems
• Reliability and FinOps: SLOs, observability, incident management, disaster recovery, cloud cost management
• Data and AI: Streaming analytics, MLOps, behavioral and anomaly detection, GenAI/LLM features and guardrails, adversarial ML
• DevSecOps: CI/CD, automated testing at scale, code signing, reproducible builds, SBOM, supply-chain security, PSIRT processes
• Standards and regulation: MITRE ATT&CK, NIST CSF, CIS Benchmarks, Zero Trust, EU Cyber Resilience Act, NIS2, FIPS 140-3, data-privacy laws
• Protocols and APIs: REST, gRPC, TLS/mTLS, certificate management, OAuth/OIDC, post-quantum cryptography basics