MacOS Endpoint Security Engineer (EDR)

Ent; United States; Remote; USD 180,000 - 240,000; Full time

Benefits offered by this job

Distributed workplace

Equity compensation

Medical, dental, and vision coverage

Flexible PTO

Maternity and paternity leave

Lifestyle account stipend

Home office stipend

Job summary

Ent is hiring an Endpoint Engineer, EDR (macOS) to design and ship the privileged daemon, per‑user agents, and system extensions that observe activity and generate high‑fidelity intent signals. You’ll own end‑to‑end EDR capabilities, from instrumentation to policy enforcement, on large enterprise fleets.

You will collaborate with security research, AI, platform, and product teams to feed sensor signals into on‑device ML classification and investigation timelines, while maintaining performance

Qualifications

• 10+ years designing and delivering production native systems software with strong Swift, C, C++, or Objective‑C.
• Deep macOS internals knowledge: processes, memory, file systems, and entitlements.
• Experience with Endpoint Security frameworks, network extensions, and EDR or similar security products.

Responsibilities

• Design, build, and ship the privileged daemon, per‑user agents, and system extensions for the macOS agent.
• Own end‑to‑end EDR detection, instrumentation, on‑box correlation, and interception logic.
• Collaborate with security research, AI, platform, and product teams to feed sensor signals into ML classification and policy enforcement.
• Review code, mentor engineers, and ensure reliable releases with on‑call readiness.

Skills

Swift

C/C++

Objective-C

macOS internals

XPC

Code signing

Endpoint Security

Performance optimization

Multithreading

Python/shell scripting

Education

Bachelor’s or higher in CS/Engineering

Tools

lldb

Instruments

Job description

Ent is hiring an Endpoint Engineer, EDR (macOS) to design and ship the privileged daemon, per‑user agents, and system extensions that observe activity and generate high‑fidelity intent signals. You’ll own end‑to‑end EDR capabilities, from instrumentation to policy enforcement, on large enterprise fleets.

You will collaborate with security research, AI, platform, and product teams to feed sensor signals into on‑device ML classification and investigation timelines, while maintaining performance