Remote Linux EDR Engineer: Kernel & eBPF

Ent; Northern (KY); Hybrid; USD 180,000 - 280,000; Full time

Benefits offered by this job

Distributed workplace

Equity

Health benefits

Flexible PTO

Maternity leave

Paternity leave

Wellness stipend

Home office stipend

Job summary

Ent is seeking an Endpoint Engineer to own the Linux sensor at the core of its EDR capability. You will design kernel- and user-space components, observe activity, and convert events into high-fidelity intent signals for secure, proactive protection across workstations, servers, and cloud workloads.

You will balance detection efficacy with false positives and performance, instrument telemetry, and harden the agent against tamper.

Qualifications

• 10+ years designing, building, and delivering production C/C++ (or Rust) systems software, especially in endpoint security or OS internals.
• Deep knowledge of OS internals: processes, memory, file systems, drivers, IPC.
• Hands-on production experience with eBPF.
• Experience with EDR/EPP/XDR or AV products and detection/response engineering.
• Fluent understanding of attacker TTPs and raw telemetry.
• Strong low-level debugging, tracing, and crash-dump analysis.
• Multithreaded programming and performance considerations under load.
• Scripting fluency for tooling and test automation (Python).
• Clear written and verbal communication with distributed teams and customers.

Responsibilities

• Design, build, and ship kernel- and user-mode components of the Ent agent for Linux.
• Own end-to-end EDR detection and prevention capability and on-box correlation.
• Balance detection efficacy, false positives, and performance with data-backed decisions.
• Instrument telemetry at OS boundaries (eBPF, LSM, audit).
• Harden the agent against tamper, bypass, and evasion in privileged contexts.
• Keep sensor CPU, memory, and I/O budgets while processing thousands of events/sec.
• Build test harnesses and automated regression coverage for continuous verification.
• Lead escalations to root cause and drive permanent fixes at code/OS level.
• Collaborate with security research, AI, platform, and product teams on policy enforcement.
• Review code, mentor engineers, document decisions, and share ownership of releases.

Skills

C/C++ or Rust

OS internals

eBPF

EDR/AV experience

low-level debugging

multi-threaded programming

Python scripting

communication

Tools

eBPF

Python

Job description

Ent is seeking an Endpoint Engineer to own the Linux sensor at the core of its EDR capability. You will design kernel- and user-space components, observe activity, and convert events into high-fidelity intent signals for secure, proactive protection across workstations, servers, and cloud workloads.

You will balance detection efficacy with false positives and performance, instrument telemetry, and harden the agent against tamper.