Remote Linux Endpoint Engineer for EDR

Ent; United States; Remote; USD 180,000 - 260,000; Full time

Benefits offered by this job

Equity

Healthcare

Flexible PTO

Maternity/Paternity leave

Lifestyle allowance

Home office stipend

Remote-friendly

Job summary

Ent is seeking an Endpoint Engineer to own the Linux sensor at the core of its EDR capability. You will design kernel- and user-mode components to observe activity and convert it into high-fidelity intent signals.

You will own end-to-end EDR detection and prevention, balance tradeoffs with data-backed decisions, and harden the agent against tampering while processing thousands of events per second. Distributed North America-wide work is supported.

Qualifications

• 10+ years designing, building, and delivering production C/C++ (or Rust) systems software, a substantial portion in endpoint security or OS internals.
• Deep knowledge of OS internals: process/thread lifecycle, memory management, filesystems, drivers or kernels, and IPC.
• Hands-on production experience with eBPF.
• Experience building or operating an EDR, EPP, XDR, or AV product, or equivalent detection‑and‑response engineering.
• Practical fluency in attacker TTPs; reason about attacks from raw telemetry, not only reports.
• Strong low-level debugging, performance tracing, and crash‑dump analysis.
• Multithreaded/concurrent programming under load; manage synchronization and race conditions.
• Track record of stable code on large fleets; performance is a product feature.
• Scripting fluency for tooling and test automation (Python or equivalent).
• Clear written and verbal communication with distributed teams and customers during escalations.

Responsibilities

• Design, build, and ship kernel- and user-mode components of the Ent agent that observe process, file, registry, network, and identity activity for Linux and turn that activity into high-fidelity intent signals.
• Own EDR-class detection and prevention capability end to end: sensor instrumentation, event enrichment, on-box correlation, and interception logic that stops malicious activity before it completes.
• Make and defend explicit tradeoffs between detection efficacy, false-positive rate, and endpoint performance, backed by measured data.
• Instrument telemetry at the OS boundary: eBPF, LSM, and audit subsystems.
• Harden the agent against tamper, bypass, and evasion — self-protection, integrity validation, and safe handling of untrusted input inside a privileged process.
• Hold sensor CPU, memory, and I/O inside strict budgets while processing thousands of events per second; profile hot paths and eliminate regressions before they ship.
• Build test harnesses, automated regression coverage so every efficacy claim is continuously verified, not asserted.
• Drive high-severity customer escalations to root cause — crashes, hangs, performance regressions, missed detections — at the code and OS-internals level, and convert escalation patterns into permanent fixes.
• Partner with the security research, AI, platform, and product teams to feed sensor signals into intent‑aware policy enforcement, just‑in‑time interventions, and investigation timelines.
• Review code, mentor engineers, document design decisions, and share ownership of agent release quality and on‑call.

Skills

C/C++ systems

OS internals

eBPF

EDR/Threat detection

Debugging & tracing

Multithreading

Performance tuning

Python scripting

Communication

Tools

eBPF

Job description

Ent is seeking an Endpoint Engineer to own the Linux sensor at the core of its EDR capability. You will design kernel- and user-mode components to observe activity and convert it into high-fidelity intent signals.

You will own end-to-end EDR detection and prevention, balance tradeoffs with data-backed decisions, and harden the agent against tampering while processing thousands of events per second. Distributed North America-wide work is supported.