Senior Linux EDR Engineer — Kernel & eBPF Expert

Ent; United States; Remote; USD 150,000 - 210,000; Full time

Benefits offered by this job

Equity

Remote-friendly across North America

Health insurance

Flexible PTO

Maternity/Paternity leave

Home office stipend

Job summary

Ent is seeking an Endpoint Engineer to own the Linux sensor at the core of its EDR capability. You will design and ship kernel- and user-space components that observe activity, transform it into high-fidelity signals, and defend against tamper and evasion while meeting strict performance budgets.

You will collaborate with security, AI, platform, and product teams to deliver end-to-end detection and prevention, instrument telemetry, and ensure scalable, reliable protection across diverse Linux

Qualifications

• 10+ years designing, building production C/C++ (or Rust) systems software in security or OS internals.
• Deep knowledge of OS internals: processes, memory, file systems, IPC.
• Hands-on production experience with eBPF.
• Experience with EDR/EPP/XDR or AV products or related detection-and-response engineering.

Responsibilities

• Design, build, and ship kernel- and user-mode components for Linux sensor.
• Own EDR detection and prevention end-to-end with telemetry and on-box correlation.
• Balance detection efficacy, false positives, and performance with data-driven decisions.
• Instrument telemetry at OS boundaries (eBPF, LSM, audit).
• Harden the agent against tamper and evasion; ensure safe handling of input in privileged context.
• Maintain budgets for sensor CPU, memory, and I/O while processing high event throughput.
• Develop test harnesses and automated regression coverage; verify efficacy continuously.
• Address high-severity escalations to root cause and implement permanent fixes.
• Collaborate with security research, AI, platform, and product teams to feed signals into policy enforcement.

Skills

C/C++/Rust

OS internals

eBPF

EDR/XDR experience

multithreaded performance

debugging and profiling

Python scripting

Tools

Kernel/driver development

Job description

Ent is seeking an Endpoint Engineer to own the Linux sensor at the core of its EDR capability. You will design and ship kernel- and user-space components that observe activity, transform it into high-fidelity signals, and defend against tamper and evasion while meeting strict performance budgets.

You will collaborate with security, AI, platform, and product teams to deliver end-to-end detection and prevention, instrument telemetry, and ensure scalable, reliable protection across diverse Linux