Endpoint Engineer, EDR (Windows)
New
E
EntCybersecurity
We also hire remotely across North America.Full-TimeSenior
Salary not disclosed
Apply NowOpens the employer's application page
Job Details
- Experience
- 10+ years
- Required Skills
- PythonCybersecurityC++Debugging
Requirements
- 10+ years designing, building, and delivering production C/C++ systems software.
- Experience in endpoint security, OS internals, or performance-critical native code.
- Deep working knowledge of operating system internals: process/thread lifecycle, memory management, file systems, drivers, and IPC.
- Hands-on production experience with kernel callbacks and minifilters.
- Demonstrated experience building or operating an EDR, EPP, XDR, or AV product.
- Practical fluency in attacker TTPs and ability to reason about raw telemetry.
- Strong low-level debugging skills, performance tracing, and crash-dump analysis.
- Proficiency in multi-threaded and concurrent programming under load.
- Track record of maintaining performance/stability on large customer fleets.
- Scripting fluency in Python or equivalent for tooling and automation.
Responsibilities
- Design, build, and ship kernel- and user-mode components of the Ent agent that observe process, file, registry, network, and identity activity for Windows.
- Own EDR-class detection and prevention capability end to end: sensor instrumentation, event enrichment, on-box correlation, and interception logic.
- Instrument telemetry at the OS boundary using ETW, kernel callbacks, and minifilters.
- Harden the agent against tamper, bypass, and evasion techniques.
- Optimize sensor CPU, memory, and I/O to handle thousands of events per second while maintaining strict performance budgets.
- Build test harnesses and automated regression coverage.
- Drive high-severity customer escalations to root cause at the code and OS-internals level.
- Partner with security research, AI, platform, and product teams to feed sensor signals into intent-aware policy enforcement.
View Full Description & ApplyYou'll be redirected to the employer's site
