Endpoint Engineer, EDR – Windows
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Endpoint Engineer building Windows kernel and user-mode EDR sensors for Ent’s workspace security platform. Improving detection, prevention, performance, and tamper resistance across customer fleets.
Responsibilities:
- Design, build, and ship kernel- and user-mode components of the Ent agent for Windows
- Observe process, file, registry, network, and identity activity and convert it into high-fidelity intent signals
- Own EDR-class detection and prevention end to end, including sensor instrumentation, event enrichment, on-box correlation, and interception logic
- Instrument telemetry at the OS boundary using ETW, kernel callbacks, and minifilters
- Harden the agent against tamper, bypass, and evasion through self-protection and integrity validation
- Keep sensor CPU, memory, and I/O within strict budgets while processing thousands of events per second
- Profile hot paths and eliminate performance regressions before release
- Build test harnesses and automated regression coverage
- Drive high-severity customer escalations to root cause, including crashes, hangs, performance regressions, and missed detections
- Convert escalation patterns into permanent fixes
- Partner with security research, AI, platform, and product teams on policy enforcement, interventions, and investigation timelines
- Review code, mentor engineers, document design decisions, and share ownership of agent release quality and on-call
Requirements:
- 10+ years designing, building, and delivering production C/C++ systems software, with a substantial portion in endpoint security, OS internals, or comparable performance-critical native code
- Deep working knowledge of operating system internals, including process and thread lifecycle, memory management, file systems, drivers or kernel extensions, and IPC
- Hands-on production experience with kernel callbacks and minifilters
- Experience building or operating an EDR, EPP, XDR, or AV product, or equivalent detection-and-response engineering
- Practical fluency in attacker TTPs and raw telemetry analysis
- Strong low-level debugging, performance tracing, and crash-dump analysis skills
- Experience with multithreaded and concurrent programming under load, including synchronization, lock contention, race conditions, and object lifetime management
- Track record of code running on large fleets without degrading end-user experience
- Scripting fluency for tooling and test automation, using Python or equivalent
- Clear written and verbal communication with distributed teams and customers
- Kernel-mode driver or kernel extension development shipped to production at scale
- Reverse engineering, malware analysis, or exploit and vulnerability research background
- Experience with anti-tamper, code integrity, driver signing, and WHQL attestation
Benefits:
- Every teammate gets meaningful equity on top of their salary
- 90% of medical, dental, and vision is paid by Ent
- 75% coverage for dependents
- Flexible PTO
- 12 weeks of fully paid maternity leave (birth, adoption, or foster)
- 8 weeks of fully paid paternity leave
- $100 monthly lifestyle account for fitness, wellness, learning, and more
- $500 home office stipend when joining as a remote employee
- Distributed workplace and remote work across North America
Similar Jobs
Field Clinical Engineer
Field Clinical Engineer promoting Abbott electrophysiology products across China. Contacting specialists, physicians, pharmacies, and distributors in a remote role.
Field Clinical Engineer
Field Clinical Engineer promoting electrophysiology products across designated channels. Contacting healthcare specialists, pharmacies, and distributors remotely in China.
Service Desk Engineer – 2nd and/or 3rd Shift
Service Desk Engineer resolving incidents and monitoring alerts for Protera’s SAP-centric enterprise cloud clients. Supporting mission-critical systems across rotational 24x7x365 shifts.
Principal Payments Engineer
Principal Payments Engineer building Payabli’s core embedded payments infrastructure. Owning exactly-once money movement, multi-rail orchestration, reconciliation, and ledger reliability at scale.
Radio Frequency Engineer – Military, Tactical, Link-16
RF spectrum engineer analyzing Link-16 communications and interference. Supporting FAA and DoD coordination to protect U.S. airspace systems.
Forward Deployed Engineer
Forward Deployed Engineer building AI-augmented CAD and simulation workflows for Synera’s engineering automation platform. Partnering with customers and product teams to deploy multi-agent solutions.
Forward Deployed Engineer
Forward Deployed Engineer building AI-augmented CAD and simulation workflows for Synera’s aerospace and automotive customers. Collaborating on-site with clients and product teams to automate engineering processes.
Senior Symfony Engineer
Lead PHP and Symfony engineer building mission-critical backend systems for Smart Working. Owning backend features, testing, deployments, and technical mentoring.
Escalator Engineer – Nights
Escalator Engineer maintaining and repairing escalators and moving walkways across Greater London transport hubs. Supporting safe, reliable operation for Stannah’s global lifts and engineering business.
Escalator Engineer – Days
Escalator Engineer maintaining and repairing escalators across Greater London transport hubs. Supporting Stannah’s manufacturing, engineering, and access solutions business in safety-critical environments.
Lift Engineer
Lift Engineer servicing, repairing, and maintaining commercial, residential, and public lifts across Essex. Supporting safe, reliable access systems for Stannah, a global mobility manufacturer.
Lift Engineer
Lift Engineer servicing, repairing, and fault-finding lifts across Bristol for Stannah, a global access-equipment manufacturer. Maintaining safe, compliant operation across commercial, residential, and public sites.
Forward Deployed Engineer
Forward Deployed Engineer building AI agents, integrations, and Knowledge Graph solutions for DevRev's unified AI work platform. Deploying customer workflows through APIs, webhooks, and real-time architectures.
Process Engineer
Process engineering support for Georgia-Pacific, a manufacturer of paper, packaging, cellulose, and building products. Supporting capital projects, asset performance, process safety, and reliability.
ICAM Engineer
Okta ICAM Engineer modernizing federal identity systems with Okta, PKI, and Zero Trust. Supporting secure ICAM integrations for Concept Plus’s federal agency clients.
Transport Engineer
Transport Network Operations Specialist supporting WDM/DWDM, SDH, Huawei and Nokia networks at Capgemini Engineering. Diagnosing high-impact incidents and coordinating N1-to-N3 resolution.
Collaboration Engineer
Collaboration Operations Engineer maintaining Microsoft 365 collaboration services for IT professional services firm. Managing incidents, platform health, L3 support, and operational improvements.
Senior Environmental Scientist, Geologist, Hydrogeologist, Engineer – Testifying Expert Witness
Environmental litigation expert witness evaluating contamination, remediation, risk, and liability matters. Advising legal counsel and clients through defensible analyses, reports, depositions, and trial testimony.
Industrial Engineer
Industrial Engineer optimizing warehouse design, flow, analytics, and processes for GXO’s global supply chain customers. Developing operational improvements, project plans, and ISO-compliant procedures.
OpenStack Engineer
OpenStack Engineer building and operating private sovereign cloud platforms for Software Mind’s enterprise clients. Deploying infrastructure, networking, monitoring, and automation across production environments.