Endpoint Engineer - Linux
Nightfall AI5 months ago
Bengaluru, IndiaSenior
Responsibilities
- Design and develop Linux data exfiltration prevention applications, kernel modules, system services, and endpoint agents.
- Build and maintain production endpoint agents that monitor and enforce DLP policies across Ubuntu, RHEL/CentOS, and other Linux distributions.
- Implement kernel-level event interception using eBPF, LSM hooks, netfilter, fanotify, or similar mechanisms for file, network, and clipboard activity.
- Develop userspace components that integrate with kernel subsystems and enforce policy decisions in real time.
- Collaborate with Mac and Windows endpoint teams on cross-platform architecture, shared policy models, and consistent DLP behavior.
- Own features end to end, including scoping, implementation, testing, and customer-facing documentation.
- Diagnose kernel panics, race conditions, file descriptor leaks, IPC failures, and other deep systems-level issues.
- Ensure endpoint agent reliability, upgrade safety, and minimal performance impact.
- Maintain internal architecture, public API, and enterprise deployment documentation.
Requirements
- Expertise in C/C++ for Linux systems development and familiarity with Go as a strong plus.
- Experience building production agents or system-level software on Linux.
- Hands-on experience with Linux kernel subsystems relevant to security and monitoring.
- Practical experience with eBPF, including BPF CO-RE, libbpf, and BCC, for tracing, network filtering, and security enforcement.
- Experience with Linux Security Modules, including SELinux, AppArmor, or custom LSM hooks.
- Working knowledge of fanotify, inotify, netlink, and procfs for system activity monitoring.
- Familiarity with Linux namespaces, cgroups, and enterprise container runtimes such as Docker and containerd.
- Experience debugging kernel-level code with ftrace, perf, crash, SystemTap, or GDB with KGDB.
- Ability to use reverse engineering and binary analysis techniques when debugging kernel-space code.
- Familiarity with enterprise Linux deployment environments and MDM tools.
- Ability to decompose complex business problems and own work end to end across teams.
- Minimum 5+ years of related systems or endpoint engineering experience.
- Preferred experience includes building DLP, EDR, or endpoint security products; contributing to Linux kernel or eBPF open-source projects; using FUSE or overlayfs; integrating auditd with SIEM tooling; working with CrowdStrike, SentinelOne, or similar XDR/EDR platforms; and understanding X11/Wayland clipboard and display server internals.
Benefits
- Compensation includes base salary, bonus for applicable roles, benefits and perks, and stock options, with finalized details reviewed during the offer discussion.
- Nightfall is an equal-opportunity employer committed to a diverse and inclusive workforce.
About Nightfall AI
Nightfall AI builds an AI-native data loss prevention platform that discovers, classifies, and protects sensitive data across SaaS apps, endpoints, email, cloud, and generative AI tools for security teams. It sells subscription software and APIs to enterprises to detect leaks and automate remediation and insider-risk controls. Founded in 2018 and headquartered in San Francisco, the privately held company raised a Series B in 2022 and focuses on cloud and AI data security.