Lead Endpoint Engineer - Linux
Nightfall AI1 month ago
Bengaluru, IndiaStaff+
Responsibilities
- Design and develop Linux data exfiltration prevention applications, kernel modules, system services, and endpoint agents.
- Build and maintain DLP agents that monitor and enforce policies across Ubuntu, RHEL/CentOS, and other Linux distributions.
- Implement kernel-level event interception using eBPF, LSM hooks, netfilter, fanotify, or similar mechanisms for file, network, and clipboard activity.
- Develop userspace components that integrate with kernel subsystems and enforce policy decisions in real time.
- Collaborate with Mac and Windows endpoint teams on cross-platform architecture, shared policy models, and consistent DLP behavior.
- Own features end to end, including scoping, implementation, testing, and customer-facing documentation.
- Diagnose kernel panics, race conditions, file descriptor leaks, IPC failures, and other systems-level issues.
- Ensure endpoint agent reliability, upgrade safety, and minimal performance impact.
- Maintain internal architecture, public API, and enterprise deployment documentation.
Requirements
- 10+ years of related systems or endpoint engineering experience.
- Expertise in C/C++ for Linux systems development and familiarity with Go.
- Demonstrable experience building production agents or system-level software on Linux.
- Hands-on experience with Linux kernel subsystems relevant to security and monitoring.
- Practical experience with eBPF, including BPF CO-RE, libbpf, and BCC.
- Experience with Linux Security Modules, including SELinux, AppArmor, or custom LSM hooks.
- Working knowledge of fanotify, inotify, netlink, and procfs.
- Familiarity with Linux namespaces, cgroups, and enterprise container runtimes.
- Experience debugging kernel-level code with tools such as ftrace, perf, crash, SystemTap, or GDB with KGDB.
- Ability to use reverse engineering and binary analysis techniques for kernel-space debugging.
- Familiarity with enterprise Linux deployment environments and MDM tools.
- Ability to decompose complex business problems and own solutions end to end across teams.
- Prior DLP, EDR, or Linux endpoint security product experience is preferred.
- Open-source Linux kernel or eBPF contributions are preferred.
- FUSE, overlayfs, auditd, SIEM, XDR/EDR, CrowdStrike, SentinelOne, clipboard, X11, and Wayland experience is preferred.
Benefits
- Equal-opportunity employer committed to a diverse and inclusive global workforce.
- Compensation, benefits, perks, bonus eligibility, and stock options are reviewed during the offer discussion.