Job description
Overview
We are looking for an experienced Backend
Developer to design and build endpoint detection and response capabilities for our security platform. You will work on the endpoint sensor, telemetry pipeline integration, and response workflows that enable high-fidelity detection and rapid containment of threats.
This role requires strong systems programming skills, deep understanding of operating system internals, and practical experience building secure, high-performance software that runs reliably on production endpoints.
Responsibilities
Design and implement endpoint sensor components for telemetry, detection, and response.
Build high-performance, low-overhead agents for Windows, macOS, and/or Linux.
Implement process, file, registry, network, memory, and module monitoring where relevant.
Develop secure communication channels between endpoint agents and backend services.
Integrate local detections with cloud or on-prem security platforms.
Create response actions such as process termination, isolation, quarantine, or configuration enforcement.
Work with detection engineers to translate behavioral logic into performant endpoint-side implementations.
Improve resilience against tampering, bypass, privilege escalation, and runtime instability.
Collaborate with SOC and IR teams to support investigations and threat containment.
Participate in code review, architecture review, threat modeling, and secure development practices.
Optimize for maintainability, crash safety, observability, and compatibility across OS versions.
Your skills and experience
Required qualifications
Strong experience in Rust, C, or C++ for production systems.
Solid understanding of operating system internals.
Experience building software that interacts with low-level OS APIs, services, drivers, or daemons.
Knowledge of endpoint security concepts such as EDR, AV, behavioral detection, and response orchestration.
Familiarity with secure software design, memory safety concerns, and defensive coding practices.
Experience debugging complex systems issues, performance bottlenecks, and concurrency problems.
Ability to work across the full lifecycle: architecture, implementation, testing, deployment, and maintenance.
Preferred qualifications
Experience with Windows internals, ETW, kernel/userland boundaries, or minifilters.
Experience with macOS system extensions, EndpointSecurity framework, or launch services.
Experience with Linux audit subsystem, eBPF, fanotify, inotify, or kernel modules.
Knowledge of detection engineering, MITRE ATT&CK, or endpoint threat hunting.
Experience hardening software against tampering, injection, and privilege abuse.
Background in security products, EDR/XDR platforms, EPP, or agent-based infrastructure.
Familiarity with Rust for systems/security applications.
Experience with telemetry pipelines, protobuf/flatbuffers, gRPC, or message queues.
Understanding of CI/CD, test automation, and release management for endpoint software.
Nice to have
Driver development or kernel-mode experience.
Experience with code signing, notarization, and endpoint trust models.
Familiarity with sandboxing, privilege separation, and secure update mechanisms.
Exposure to incident response operations or SOC workflows.
Experience contributing to open-source security or systems projects.
Why you'll love working here
Work on system-level, high traffic architecture
Opportunity to grow into Senior/Tech Lead in distributed systems
Modern tech stack: Rust, C, or C++