Senior Endpoint Engineer, EDR (macOS)
Ent · Remote · Remote ·
COMPENSATION
€•• – ••k
Listed on the employer's job board (Ashby)
- Senior level role
- Fully remote (NA)
- macOS internals focus
- Swift + C/C++
- Equity included
You will design and ship the core macOS agent components, including privileged daemons and per-user agents. Your work focuses on observing system activity to generate high-fidelity signals about user and AI intent, enabling real-time risk intervention.
The team builds an intent-aware workspace security platform used by Global 2000 companies. You will collaborate with security research and AI teams to feed sensor data into on-device classification and policy enforcement systems.
What you'll do
- Design and ship privileged daemons, agents, and system extensions for macOS.
- Implement EDR detection and prevention via Endpoint Security framework and Network Extensions.
- Instrument telemetry using FSEvents, IOKit, and event taps for data-movement signals.
- Maintain multi-process architecture with XPC protocols and code-signing authentication.
- Harden the agent against tampering, bypass attempts, and evasion techniques.
- Optimize CPU, memory, and I/O usage to handle thousands of events per second.
- Build automated regression coverage and VM-based end-to-end test harnesses.
- Resolve high-severity customer escalations involving crashes or performance issues.
- Partner with AI and product teams to integrate sensor signals into ML classification.
What you'll need
- 10+ years building production native systems software in Swift, C, C++, or Objective-C.
- Deep knowledge of macOS internals including process lifecycle, memory, and file systems.
- Hands-on experience with Endpoint Security framework and System Extensions.
- Background in building or operating EDR, EPP, XDR, or DLP products.
- Fluency in attacker TTPs and ability to analyze raw telemetry for threats.
- Strong low-level debugging skills using lldb, crash dumps, and Instruments.
- Experience with multi-threaded programming, synchronization, and actor isolation.
- Track record of running stable code on large enterprise fleets without degradation.
- Proficiency in scripting languages like Python or shell for test automation.
Nice to have
- Background in reverse engineering, malware analysis, or vulnerability research.
- Experience shipping on-device ML inference in resource-constrained environments.
- Knowledge of browser extension or native-messaging integrations for telemetry.
- Cross-platform endpoint agent experience with Windows or Linux sensors.
Stack
- Swift
- C
- C++
- Objective-C
- Endpoint Security framework
- Network Extensions
- FSEvents
- IOKit
- XPC
- Python
How you'll work
- Remote work available across North America
- Distributed workplace model
- On-call responsibilities for agent release quality
What you get
- Meaningful equity package for all teammates
- 90% medical, dental, and vision coverage paid by company
- 75% coverage for dependents
- Flexible paid time off policy
- 12 weeks fully paid maternity leave
- 8 weeks fully paid paternity leave
- $100 monthly lifestyle account for wellness and learning
- $500 home office stipend for remote employees