Lead Endpoint Engineer - Linux
RemoteBengaluru, Karnataka, India or India
Job Summary
Design and develop data exfiltration prevention applications, kernel modules, and agents on Linux to monitor and enforce DLP policies across Ubuntu, RHEL/CentOS, and other distributions. Implement kernel-level event interception using eBPF, LSM hooks, and fanotify to track file, network, and clipboard activity in real time. Build userspace components that integrate with kernel subsystems and collaborate with Mac and Windows teams to align cross-platform agent architecture. Own complex features from design through delivery, including scoping, implementation, testing, and customer-facing documentation. Diagnose deep systems-level issues such as kernel panics, race conditions, and IPC failures while ensuring agent reliability and minimal performance footprint. Write internal architecture and deployment guides for enterprise customers.
Required Qualifications
- Expertise in C/C++ for Linux systems development
- Demonstrable experience building production agents or system-level software on Linux
- Deep hands-on experience with one or more Linux kernel subsystems relevant to security and monitoring
- Practical knowledge of eBPF (including BPF CO-RE, libbpf, and BCC) for tracing, network filtering, and security enforcement
- Experience with Linux Security Modules (LSM) - SELinux, AppArmor, or custom LSM hooks
- Working knowledge of fanotify, inotify, netlink, and procfs for system activity monitoring
- Familiarity with Linux namespaces, cgroups, and container runtimes (Docker, containerd) in enterprise deployments
- Experience with kernel-level debugging using tools such as ftrace, perf, crash, SystemTap, or GDB with KGDB
- Ability to use reverse engineering and binary analysis techniques when debugging kernel space code
- Familiarity with enterprise Linux deployment environments - MDM tools
- Ability to decompose complex business problems and own them end to end across teams
- 10+ years of related systems/endpoint engineering experience
Desired Qualifications
- Familiarity with Go
- Prior experience building DLP, EDR, or endpoint security products on Linux
- Contributions to open-source Linux kernel or eBPF ecosystem projects
- Experience with FUSE (Filesystem in Userspace) or overlayfs for file activity interception
- Knowledge of Linux audit subsystem (auditd) and its integration with SIEM tooling
- Experience developing or integrating with XDR/EDR platforms (CrowdStrike, SentinelOne, or similar)
- Familiarity with clipboard and X11/Wayland display server internals for content inspection
- Background in Go for high-performance agent components
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.