Senior Endpoint EDR Engineer - Windows Kernel & Security

ENT; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Equity

Distributed work across North America

Medical, dental, vision benefits

PTO & Holidays

Home office stipend

Job summary

Ent is seeking an experienced Endpoint Engineer, EDR (Windows) to design and ship kernel- and user-mode components observing Windows activity and turning it into high-fidelity signals about intent. You will own end-to-end EDR detection, instrumentation, and interception logic while meeting tight budgets.

You will instrument telemetry at the OS boundary, harden against tamper and evasion, and collaborate with security research, AI, platform, and product teams to drive policy enforcement and fast

Qualifications

• 10+ years designing, building, and delivering production C/C++ systems software.
• Deep knowledge of operating system internals: processes, memory, files, drivers.
• Hands-on experience with kernel callbacks and minifilters.
• Background in EDR/AV or detection-and-response engineering.
• Strong debugging, profiling, and crash-dump analysis skills.

Responsibilities

• Design, build, and ship kernel- and user-mode components observing Windows activity and turning it into signals.
• Own end-to-end EDR detection, including instrumentation, enrichment, and interception logic.
• Instrument telemetry at the OS boundary (ETW, callbacks, minifilters).
• Harden the agent against tamper and evasion; ensure safe handling of untrusted input.
• Work with cross-functional teams to drive policy enforcement and investigations.

Skills

C/C++ development

OS internals

EDR/AV experience

Kernel callbacks/minifilters

Low-level debugging

Multithreaded programming

Python scripting

Performance optimization

Customer communications

Code reviews/mentoring

Tools

ETW

Kernel extensions

Job description

Ent is seeking an experienced Endpoint Engineer, EDR (Windows) to design and ship kernel- and user-mode components observing Windows activity and turning it into high-fidelity signals about intent. You will own end-to-end EDR detection, instrumentation, and interception logic while meeting tight budgets.

You will instrument telemetry at the OS boundary, harden against tamper and evasion, and collaborate with security research, AI, platform, and product teams to drive policy enforcement and fast