SENIOR ENDPOINT ENGINEER, EDR (LINUX)

Ent is the intent-aware workspace security platform for securing human and AI-driven work. Built to protect productivity, the recent attack surface, Ent understands not just what users and agents do but why, and intervenes at the moment of risk before incidents occur. Where existing tools see events, Ent sees intent, so security teams can step in at the moment of risk instead of investigating days later. Founded by Lou Manousos and Brandon Dixon, co-founders of RiskIQ (acquired by Microsoft) and the team behind Microsoft Security Copilot, Ent is in production with Global 2000 customers across hospitality, financial services, and defense, and backed by Decibel, Sequoia, Crosspoint Capital, Craft Ventures, Shield Capital, Felicis, and In-Q-Tel. We’re now hiring the team that will define this category.

Customer first. The product and the business are built around problems we’ve watched real security teams struggle with — not the other way around. No drama. The window to build a durable security company in the AI era is open right now and it will not stay open. We are seeking an Endpoint Engineer to be part of the team that owns the Linux sensor at the core of Ent's EDR capability. This role builds detection and prevention on eBPF, LSM, and the audit subsystem, across the range of Linux customers actually run — workstations, servers, containers, and cloud workloads. You will own the tradeoffs between detection efficacy, false positives, and performance, and defend them with measured data.

Design, build, and ship kernel- and user-mode components of the Ent agent that observe process, file, registry, network, and identity activity for Linux and turn that activity into high-fidelity intent signals.





- Make and defend explicit tradeoffs between detection efficacy, false-positive rate, and endpoint performance, backed by measured data rather than intuition.
- profile hot paths and eliminate regressions before they ship.
- Build test harnesses, automated regression coverage so every efficacy claim is continuously verified, not asserted.
- Drive high-severity customer escalations to root cause — crashes, hangs, performance regressions, missed detections — at the code and OS-internals level, and convert escalation patterns into permanent fixes.
- Partner with the security research, AI, platform, and product teams to feed sensor signals into intent-aware policy enforcement, just-in-time interventions, and investigation timelines.
- Review code, mentor engineers, document design decisions, and share ownership of agent release quality and on-call.

10+ years designing, building, and delivering production C/C++ (or Rust) systems software, a substantial portion of it in endpoint security, OS internals, or comparable performance-critical native code.

- Demonstrated experience building or operating an EDR, EPP, XDR, or AV product, or equivalent detection-and-response engineering.
- Strong low-level debugging skills, performance tracing, and crash-dump analysis.
- Multi-threaded and concurrent programming under load — synchronization, lock contention, race conditions,



and object lifetime management.
- A track record of code running on large fleets without degrading end-user experience; you treat stability and performance as product features.
- Scripting fluency for tooling and test automation (Python or equivalent).
- Clear written and verbal communication with distributed teams and, when escalations demand it, directly with customers.

BONUS

- Kernel-mode driver or kernel extension development shipped to production at scale.
- While we have positions we hire for in our SF office, we also hire remotely across North America.
- Every teammate gets meaningful equity on top of their salary.
- 90% of your medical, dental, and vision is paid by Ent. Our flexible PTO lets you recharge, travel, or just take a breather.
- 12 weeks of fully paid maternity leave (birth, adoption, or foster) and 8 weeks fully paid paternity leave.
- A $100 monthly lifestyle account to spend on what keeps you healthy and happy — fitness, wellness, learning, and more.
- A $500 home office stipend when you join as a remote employee.

DIVERSITY & ACCOMMODATIONS

We’re committed to building a diverse, inclusive, and equitable workplace where people of all backgrounds, identities, experiences, and abilities are welcomed, valued, and supported. We recognize there is no single path to success and value nontraditional career journeys and diverse perspectives as key to building stronger, more innovative teams.

We strive to ensure an inclusive experience at every stage of hiring and are happy to provide reasonable accommodations. As an equal opportunity employer, our hiring process is designed to put you at ease and help you do your best work.

📌 Senior Linux Engineer (remote) (Canada)
🏢 Ent Security
📍 Canada