Endpoint Engineer, EDR – Linux

Job not on LinkedIn

🔥 5 hours ago

🏈 North America – Remote

⏰ Full Time

🟠 Senior

🔴 Lead

🧑‍💻 Full-stack Engineer

👻 Ghost score 23%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

ENT

WebsiteLinkedInAll Job Openings

11 - 50 employees

Founded 2001

💼 Consulting

🤝 Non-profit

🔬 Science

Consulting • Non-profit • Science

ENT is a socio‑economic initiative made up of two organizations (a consultancy and a foundation) that deliver multidisciplinary professional services focused on environmental policy, research and innovation. For more than 20 years they have worked on the design, analysis and management of environmental policies and instruments — especially waste management, environmental taxation, producer responsibility and deposit-return systems — as well as climate change, marine environment and ecology. ENT participates in R+D+i projects, publishes research, offers training and advisory services, and holds ISO 9001 and 14001 certifications.

📋 Description

• Own the Linux sensor at the core of Ent's EDR capability • Design, build, and ship kernel- and user-mode components of the Ent agent • Observe process, file, registry, network, and identity activity on Linux and convert it into high-fidelity intent signals • Own EDR-class detection and prevention end to end, including sensor instrumentation, event enrichment, on-box correlation, and interception logic • Make and defend tradeoffs among detection efficacy, false-positive rate, and endpoint performance using measured data • Instrument telemetry at the OS boundary using eBPF, LSM, and audit subsystems • Harden the agent against tamper, bypass, and evasion • Maintain strict CPU, memory, and I/O budgets while processing thousands of events per second • Profile hot paths and eliminate performance regressions • Build test harnesses and automated regression coverage • Drive high-severity customer escalations to root cause and convert patterns into permanent fixes • Partner with security research, AI, platform, and product teams on policy enforcement, interventions, and investigation timelines • Review code, mentor engineers, document design decisions, and share ownership of agent release quality and on-call

🎯 Requirements

• 10+ years designing, building, and delivering production C/C++ or Rust systems software • Substantial experience in endpoint security, OS internals, or comparable performance-critical native code • Deep knowledge of operating system internals, including process and thread lifecycle, memory management, file systems, drivers or kernel extensions, and IPC • Hands-on production experience with eBPF • Experience building or operating an EDR, EPP, XDR, or AV product, or equivalent detection-and-response engineering • Practical fluency in attacker TTPs • Strong low-level debugging, performance tracing, and crash-dump analysis skills • Experience with multithreaded and concurrent programming under load, including synchronization, lock contention, race conditions, and object lifetime management • Track record of deploying code across large fleets without degrading end-user experience • Scripting fluency for tooling and test automation, such as Python or equivalent • Clear written and verbal communication with distributed teams and customers • Kernel-mode driver or kernel extension development shipped to production at scale (bonus) • Reverse engineering, malware analysis, or exploit and vulnerability research background (bonus) • Experience with anti-tamper and code integrity (bonus)

🏖️ Benefits

• Meaningful equity on top of salary • 90% of medical, dental, and vision premiums paid by Ent • 75% coverage for dependents • Flexible PTO • 12 weeks of fully paid maternity leave (birth, adoption, or foster) • 8 weeks of fully paid paternity leave • $100 monthly lifestyle account for fitness, wellness, learning, and more • $500 home office stipend for remote employees • Distributed workplace and remote work across North America