Senior Linux Endpoint Security Engineer (EDR)

ENT; United States; Remote; USD 180,000 - 240,000; Full time

Benefits offered by this job

Equity

Remote work across North America

Medical/Dental/Vision

Flexible PTO

Maternity/Paternity leave

Lifestyle stipend

Home office stipend

Job summary

Ent seeks a Senior Endpoint Engineer to own the Linux sensor at the core of its EDR capability. You will design and ship kernel- and user-mode components observing activity across Linux systems and translate it into high-fidelity intent signals.

You’ll balance detection efficacy with performance and collaborate with security researchers and product teams. You will harden the agent against tamper, profile hot paths, and drive regression coverage.

Qualifications

• 10+ years designing, building, and delivering production C/C++ (or Rust) systems software.
• Deep working knowledge of operating system internals: processes, memory, files, IPC.
• Hands-on production experience with eBPF.
• Demonstrated experience building or operating an EDR, EPP, XDR, or AV product, or equivalent detection-and-response.
• Practical fluency in attacker TTPs; analyzing raw telemetry beyond reports.
• Strong low-level debugging skills, performance tracing, and crash-dump analysis.
• Multi-threaded/concurrent programming under load with stable behavior.
• Scripting fluency for tooling and test automation (Python or equivalent).

Responsibilities

• Design, build, and ship kernel- and user-mode components of the Ent agent for Linux.
• Own EDR-class detection and prevention end-to-end: instrumentation, enrichment, on-box correlation, interception.
• Balance detection efficacy, false positives, and performance using measured data.
• Instrument telemetry at OS boundaries: eBPF, LSM, and audit subsystems.
• Harden the agent against tamper, bypass, and evasion; ensure safe handling of untrusted input.
• Keep sensor CPU, memory, and I/O within budgets as events scale to thousands per second.
• Build test harnesses and automated regression coverage to verify efficacy.
• Lead escalations to root cause and drive permanent fixes with cross-team collaboration.
• Collaborate with security research, AI, platform, and product teams to align signals to policy.
• Review code, mentor engineers, document decisions, and share ownership of releases.

Skills

C/C++

Rust

OS internals

eBPF

EDR experience

Debugging

Multithreading

Python

Job description

Ent seeks a Senior Endpoint Engineer to own the Linux sensor at the core of its EDR capability. You will design and ship kernel- and user-mode components observing activity across Linux systems and translate it into high-fidelity intent signals.

You’ll balance detection efficacy with performance and collaborate with security researchers and product teams. You will harden the agent against tamper, profile hot paths, and drive regression coverage.