Senior Linux EDR Engineer: Kernel & eBPF

Openkrill; United States; Remote; USD 180,000 - 240,000; Full time

Benefits offered by this job

Equity participation

Remote across North America

Health, dental, vision coverage (75%+)

Flexible PTO

Maternity/Paternity leave

Job summary

Ent is seeking a Senior Endpoint Engineer to own the Linux sensor at the core of its EDR capability. You will design and ship kernel- and user-space components, balance detection efficacy with performance, and defend findings with data across large fleets.

You will harden the agent, instrument OS telemetry, and drive high-severity escalations to permanent fixes, collaborating with security research, AI, and product teams across North America.

Qualifications

• 10+ years designing, building, and delivering production C/C++ (or Rust) systems software.
• Deep knowledge of OS internals: processes, memory, IPC.
• Hands-on production experience with eBPF.
• Experience building/operating EDR/XDR/AV or equivalent RR engineering.
• Fluency in attacker TTPs; read telemetry, not just reports.
• Strong low-level debugging, tracing, and crash-dump analysis.
• Multi-threaded programming under load; manage synchronization and race conditions.
• Track record of scalable code in large fleets with stability as a feature.
• Scripting in Python or equivalent.

Responsibilities

• Design, build, and ship kernel- and user-mode components for the Linux sensor.
• Own end-to-end EDR detection and prevention: instrumentation, enrichment, correlation, interception.
• Balance detection efficacy, false positives, and performance with data-backed decisions.
• Instrument OS telemetry via eBPF, LSM, and audit subsystems.
• Harden the agent against tamper, bypass, and evasion; ensure integrity.

Skills

C/C++ development

Rust development

OS internals

eBPF experience

EDR experience

Multithreading

Performance sensitive

Python scripting

Tools

eBPF

Kernel debugging

Python scripting

Job description

Ent is seeking a Senior Endpoint Engineer to own the Linux sensor at the core of its EDR capability. You will design and ship kernel- and user-space components, balance detection efficacy with performance, and defend findings with data across large fleets.

You will harden the agent, instrument OS telemetry, and drive high-severity escalations to permanent fixes, collaborating with security research, AI, and product teams across North America.