Job description

We are looking for an exceptional engineer to help us grow this agent to protect a very large fleet, and to do it without ever taking production down. You will bring two things at once: the engineering depth to ship new capabilities quickly, and a reliability mindset that treats every release as something that runs on production hosts. You will take vague, high-stakes problems and turn them into working software, working with other teams to find out what to build and how. This is not a role where you will be handed pre-defined tickets. 7+ years of professional experience building, shipping and supporting production software or system software. Personal proficiency, in at least one high-level or scripting language (Python or Rust) and at least one low-level systems language (C or C++). Solid knowledge of operating system internals (processes, threads, memory, system calls, namespaces). Linux, macOS or both. Credible understanding of attacker behavior and security concepts, and of how malicious activity shows up in host telemetry such as process, network and file events. Experience building or operating endpoint, host or agent software deployed at large scale, with performance and availability objectives. Experience with eBPF, EndpointSecurity or similar OS-level instrumentation, and an understanding of how those mechanisms can be evaded or disabled. Experience with Swift on server, concurrency in Swift, and cross-platform builds. Understanding of EDR or host-based detection techniques and the current industry state of the art. Experience with policy-driven detection logic (for example OPA/Rego), and with statistical techniques such as probabilistic data structures for bounded-memory anomaly detection. Experience with virtualization and hypervisor environments. Experience building CI/CD and release tooling for software deployed to hosts, including staged rollout and rollback.

Requirements

Must-haves

7+ years of professional experience building, shipping and supporting production software or system software.
Personal proficiency, in at least one high-level or scripting language (Python or Rust) and at least one low-level systems language (C or C++).
Solid knowledge of operating system internals (processes, threads, memory, system calls, namespaces). Linux, macOS or both.
Credible understanding of attacker behavior and security concepts, and of how malicious activity shows up in host telemetry such as process, network and file events.
Experience building or operating endpoint, host or agent software deployed at large scale, with performance and availability objectives.
Experience with eBPF, EndpointSecurity or similar OS-level instrumentation, and an understanding of how those mechanisms can be evaded or disabled.
Experience with Swift on server, concurrency in Swift, and cross-platform builds.
Understanding of EDR or host-based detection techniques and the current industry state of the art.
Experience with policy-driven detection logic (for example OPA/Rego), and with statistical techniques such as probabilistic data structures for bounded-memory anomaly detection.
Experience with virtualization and hypervisor environments.
Experience building CI/CD and release tooling for software deployed to hosts, including staged rollout and rollback.

Nice-to-haves

None flagged.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

pythonrustswiftci/cd

Platform: apple
Effort: medium