Ent
Senior Endpoint Engineer, EDR (linux)
Remote · Remote · Senior · Full-time · Posted Sep 4, 2026
- Experience
- 10+ years; the posting does not specify an alternative duration.
About the job
Build and maintain Ent’s Linux EDR sensor, developing detection and prevention capabilities while balancing accuracy, false positives, and endpoint performance.
What you'll do
- Build kernel- and user-mode agent components and instrument Linux activity using eBPF, LSM, and audit subsystems.
- Own detection and prevention from sensor instrumentation through correlation and interception; harden the agent and maintain performance and reliability.
- Investigate customer escalations, build automated regression tests, and collaborate across security research, AI, platform, and product teams.
What they ask for
- 10+ years delivering production C/C++ (or Rust) systems software, including substantial endpoint security, OS internals, or comparable performance-critical native code.
- Deep knowledge of operating system internals and hands-on production eBPF experience.
- Experience building or operating an EDR, EPP, XDR, or AV product, or equivalent detection-and-response engineering.
- Low-level debugging, performance tracing, crash-dump analysis, concurrent programming, and scripting fluency (Python or equivalent).
Nice to have
- Production kernel-mode driver or kernel extension development at scale.
- Reverse engineering, malware analysis, exploit or vulnerability research, or anti-tamper and code integrity experience.
Tools
C/C++, Rust, eBPF, LSM, Python
AI focus
Partner with AI and other teams to feed sensor signals into intent-aware policy enforcement, just-in-time interventions, and investigation timelines.
Model-written summary · the original posting is authoritative