Endpoint Engineer, EDR – macOS

Job not on LinkedIn

🔥 6 hours ago

🏈 North America – Remote

⏰ Full Time

🟠 Senior

🔴 Lead

🍏 iOS Engineer

👻 Ghost score 23%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

ENT

WebsiteLinkedInAll Job Openings

11 - 50 employees

Founded 2001

💼 Consulting

🤝 Non-profit

🔬 Science

Consulting • Non-profit • Science

ENT is a socio‑economic initiative made up of two organizations (a consultancy and a foundation) that deliver multidisciplinary professional services focused on environmental policy, research and innovation. For more than 20 years they have worked on the design, analysis and management of environmental policies and instruments — especially waste management, environmental taxation, producer responsibility and deposit-return systems — as well as climate change, marine environment and ecology. ENT participates in R+D+i projects, publishes research, offers training and advisory services, and holds ISO 9001 and 14001 certifications.

📋 Description

• Design, build, and ship the privileged daemon, per-user agents, and system extensions comprising the macOS agent • Observe process, file, network, device, and user-interaction activity and convert it into intent signals • Own EDR-class detection and prevention end to end, including instrumentation, event enrichment, correlation, rule evaluation, and interception logic • Instrument telemetry using the Endpoint Security framework, Network Extensions, FSEvents, IOKit, and event taps • Design and maintain the launchd-managed, multi-process architecture and XPC protocols • Implement code-signing-based peer authentication and safely handle untrusted input in privileged processes • Harden the agent against tampering, bypass, and evasion • Keep CPU, memory, and I/O within strict budgets while processing thousands of events per second • Build test harnesses and automated regression coverage, including VM-based end-to-end testing • Resolve high-severity customer escalations involving crashes, hangs, performance regressions, missed detections, permission failures, and deployment failures • Partner with security research, AI, platform, and product teams on ML classification, policy enforcement, interventions, and investigation timelines • Review code, mentor engineers, document design decisions, and share ownership of release quality and on-call

🎯 Requirements

• 10+ years designing, building, and delivering production native systems software • Strong, current Swift skills, including modern concurrency (actors, Sendable, structured concurrency) • Substantial experience in endpoint security, OS internals, or comparable performance-critical code • Deep knowledge of macOS internals, including process and thread lifecycle, memory management, file systems, code signing and entitlements, launchd, XPC and Mach IPC, and the TCC permission model • Production experience with the Endpoint Security framework and/or Network Extensions • Understanding of the system extension lifecycle that replaced kernel extensions • Experience building or operating an EDR, EPP, XDR, DLP, or insider-risk product, or equivalent detection-and-response engineering • Practical fluency in attacker TTPs • Low-level debugging skills with lldb, crash-dump and hang analysis, and Instruments or equivalent • Experience with multithreaded and concurrent programming under load • Track record of deploying code on large fleets without degrading end-user experience • Understanding of enterprise deployment realities, including MDM profiles, notarization, staged rollout, and auto-update • Scripting fluency in Python, shell, or equivalent • Clear written and verbal communication with distributed teams and customers when needed • Reverse engineering, malware analysis, or exploit and vulnerability research background (bonus) • Experience shipping on-device ML inference (Core ML, ONNX Runtime, or llama.cpp-class runtimes) in a resource-constrained agent (bonus) • Experience with browser extension or native-messaging integrations for telemetry capture (bonus) • Cross-platform endpoint agent experience with Windows or Linux sensors alongside macOS (bonus)

🏖️ Benefits

• Meaningful equity on top of salary • 90% of medical, dental, and vision coverage paid by Ent • 75% coverage for dependents • Flexible PTO • 12 weeks of fully paid maternity leave (birth, adoption, or foster) • 8 weeks of fully paid paternity leave • $100 monthly lifestyle account for fitness, wellness, learning, and more • $500 home office stipend for remote employees