Endpoint Engineer, EDR – macOS

Posted 3 weeks ago

Apply Now

Resume Score

Check how well your resume matches this job before you apply.

Sign in to check score

About the role

  • Endpoint Engineer building macOS EDR sensors for Ent’s workspace security platform. Designing privileged agents, telemetry pipelines, and prevention controls across customer fleets.

Responsibilities

  • Design, build, and ship the privileged daemon, per-user agents, and system extensions comprising the macOS agent
  • Observe process, file, network, device, and user-interaction activity and convert it into intent signals
  • Own EDR-class detection and prevention end to end, including instrumentation, event enrichment, correlation, rule evaluation, and interception logic
  • Instrument telemetry using the Endpoint Security framework, Network Extensions, FSEvents, IOKit, and event taps
  • Design and maintain the launchd-managed, multi-process architecture and XPC protocols
  • Implement code-signing-based peer authentication and safely handle untrusted input in privileged processes
  • Harden the agent against tampering, bypass, and evasion
  • Keep CPU, memory, and I/O within strict budgets while processing thousands of events per second
  • Build test harnesses and automated regression coverage, including VM-based end-to-end testing
  • Resolve high-severity customer escalations involving crashes, hangs, performance regressions, missed detections, permission failures, and deployment failures
  • Partner with security research, AI, platform, and product teams on ML classification, policy enforcement, interventions, and investigation timelines
  • Review code, mentor engineers, document design decisions, and share ownership of release quality and on-call

Requirements

  • 10+ years designing, building, and delivering production native systems software
  • Strong, current Swift skills, including modern concurrency (actors, Sendable, structured concurrency)
  • Substantial experience in endpoint security, OS internals, or comparable performance-critical code
  • Deep knowledge of macOS internals, including process and thread lifecycle, memory management, file systems, code signing and entitlements, launchd, XPC and Mach IPC, and the TCC permission model
  • Production experience with the Endpoint Security framework and/or Network Extensions
  • Understanding of the system extension lifecycle that replaced kernel extensions
  • Experience building or operating an EDR, EPP, XDR, DLP, or insider-risk product, or equivalent detection-and-response engineering
  • Practical fluency in attacker TTPs
  • Low-level debugging skills with lldb, crash-dump and hang analysis, and Instruments or equivalent
  • Experience with multithreaded and concurrent programming under load
  • Track record of deploying code on large fleets without degrading end-user experience
  • Understanding of enterprise deployment realities, including MDM profiles, notarization, staged rollout, and auto-update
  • Scripting fluency in Python, shell, or equivalent
  • Clear written and verbal communication with distributed teams and customers when needed
  • Reverse engineering, malware analysis, or exploit and vulnerability research background (bonus)
  • Experience shipping on-device ML inference (Core ML, ONNX Runtime, or llama.cpp-class runtimes) in a resource-constrained agent (bonus)
  • Experience with browser extension or native-messaging integrations for telemetry capture (bonus)
  • Cross-platform endpoint agent experience with Windows or Linux sensors alongside macOS (bonus)

Benefits

  • Meaningful equity on top of salary
  • 90% of medical, dental, and vision coverage paid by Ent
  • 75% coverage for dependents
  • Flexible PTO
  • 12 weeks of fully paid maternity leave (birth, adoption, or foster)
  • 8 weeks of fully paid paternity leave
  • $100 monthly lifestyle account for fitness, wellness, learning, and more
  • $500 home office stipend for remote employees

Job title

Job type

Full Time

Experience level

SeniorLead

Salary

Not specified

Degree requirement

No Education Requirement

Tech skills

LinuxMacOSPythonSwift

Location requirements

RemoteNorth America

Report this job

Found something wrong with the page? Please let us know by submitting a report below.