Endpoint Engineer - Linux
Nightfall AI4 months ago
Bengaluru, IndiaSenior
Responsibilities
- Design and develop Linux data exfiltration prevention applications, kernel modules, system services, and endpoint agents.
- Build and maintain production endpoint agents that monitor and enforce DLP policies across Ubuntu, RHEL/CentOS, and other Linux distributions.
- Implement kernel-level event interception using eBPF, LSM hooks, netfilter, fanotify, or similar mechanisms for file, network, and clipboard activity.
- Develop userspace components that integrate with kernel subsystems and enforce policy decisions in real time.
- Collaborate with Mac and Windows endpoint teams on cross-platform architecture, shared policy models, and consistent DLP behavior.
- Own features end to end, including scoping, implementation, testing, and customer-facing documentation.
- Diagnose kernel panics, race conditions, file descriptor leaks, IPC failures, and other deep systems-level issues.
- Ensure endpoint agent reliability, upgrade safety, and minimal performance impact.
- Maintain internal architecture, public API, and enterprise deployment documentation.
Requirements
- Expertise in C/C++ for Linux systems development and familiarity with Go as a strong plus.
- Experience building production agents or system-level software on Linux.
- Hands-on experience with Linux kernel subsystems relevant to security and monitoring.
- Practical experience with eBPF, including BPF CO-RE, libbpf, and BCC, for tracing, network filtering, and security enforcement.
- Experience with Linux Security Modules, including SELinux, AppArmor, or custom LSM hooks.
- Working knowledge of fanotify, inotify, netlink, and procfs for system activity monitoring.
- Familiarity with Linux namespaces, cgroups, and enterprise container runtimes such as Docker and containerd.
- Experience debugging kernel-level code with ftrace, perf, crash, SystemTap, or GDB with KGDB.
- Ability to use reverse engineering and binary analysis techniques when debugging kernel-space code.
- Familiarity with enterprise Linux deployment environments and MDM tools.
- Ability to decompose complex business problems and own work end to end across teams.
- Minimum 5+ years of related systems or endpoint engineering experience.
- Preferred experience includes building DLP, EDR, or endpoint security products; contributing to Linux kernel or eBPF open-source projects; using FUSE or overlayfs; integrating auditd with SIEM tooling; working with CrowdStrike, SentinelOne, or similar XDR/EDR platforms; and understanding X11/Wayland clipboard and display server internals.
Benefits
- Compensation includes base salary, bonus for applicable roles, benefits and perks, and stock options, with finalized details reviewed during the offer discussion.
- Nightfall is an equal-opportunity employer committed to a diverse and inclusive workforce.