{"id":698897,"url":"https://alion.io/job/ent-endpoint-engineer-edr-macos","title":"Senior Endpoint Engineer, EDR (macOS)","company":{"id":673402,"name":"Ent","domain":"ent.ai","url":"https://alion.io/company/ent-4","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":75,"open_postings":4,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":22,"computed_at":"2026-10-28T05:59:10Z"}},"role":"Support","role_family":"Support","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_regions","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["US","CA","MX","AI","AG","AW","BS","BB","BZ","BM","VG","BQ","KY","CR","CW","DM","DO","SV","GL","GD","GP","GT","HT","HN","JM","MQ","MS","NI","PA","PR","KN","LC","VC","PM","SX","TT","TC","VI"],"hiring_countries_total":38,"salary":null,"salary_estimate":{"min_usd":78000,"max_usd":156000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":104},"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"C++","optional":false},{"name":"Copilot","optional":false},{"name":"Core ML","optional":false},{"name":"DLP","optional":false},{"name":"Edge AI","optional":false},{"name":"Linux","optional":false},{"name":"llama.cpp","optional":false},{"name":"Objective-C","optional":false},{"name":"ONNX Runtime","optional":false},{"name":"Python","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-09-04T06:35:11Z","employer_posted_date":"2026-09-04","last_verified_at":"2026-10-28T14:57:39Z","board_verified":true,"closed_at":null,"days_open":54,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":54},"description":"Senior Endpoint Engineer, EDR (macOS)\nAbout Ent\nEnt is the intent-aware workspace security platform for securing human and AI-driven work. Built to protect productivity, the new attack surface, Ent understands not just what users and agents do but why, and intervenes at the moment of risk before incidents occur. Where existing tools see events, Ent sees intent, so security teams can step in at the moment of risk instead of investigating days later. Founded by Lou Manousos and Brandon Dixon, co-founders of RiskIQ (acquired by Microsoft) and the team behind Microsoft Security Copilot, Ent is in production with Global 2000 customers across hospitality, financial services, and defense, and backed by Decibel, Sequoia, Crosspoint Capital, Craft Ventures, Shield Capital, Felicis, and In-Q-Tel. We’re now hiring the team that will define this category.\nHow We Work\nCustomer first. The product and the business are built around problems we’ve watched real security teams struggle with - not the other way around. Every roadmap conversation starts with what a CISO told us last week.\nHumble. No drama. We hire people who share the mission and trust each other to deliver. Teamwork over showmanship. Accountability over politics. The work speaks louder than the person doing it.\nUrgency. The window to build a durable security company in the AI era is open right now and it will not stay open. The shot clock has started. We move at the speed of the people we want to protect.\nAbout the Role\nAs an Endpoint Engineer, EDR (macOS), you'll design and ship the privileged daemon, per-user agents, and system extensions that observe process, file, network, device, and user-interaction activity and turn it into high-fidelity signals about what an actor is actually trying to do.\nYou'll own EDR-class detection and prevention end to end: instrumentation through the Endpoint Security framework, Network Extensions, FSEvents, and IOKit; event enrichment and on-box correlation; and the interception logic - ES AUTH decisions, network flow filtering - that stops malicious activity before it completes. The constraints are real. The sensor spans multiple processes joined by XPC, runs privileged on large customer fleets, handles thousands of events per second against hard deadlines, and has to resist tamper and evasion without degrading the machine.\nYou'll work closely with security research, AI, platform, and product to feed sensor signals into on-device classification, policy enforcement, and investigation timelines.\nWhat You’ll Achieve\nDesign, build, and ship the privileged daemon, per-user agents, and system extensions that make up the macOS agent: observing process, file, network, device, and user-interaction activity and turning it into intent signals.\n\nOwn EDR-class detection and prevention capability end to end: sensor instrumentation, event enrichment, on-box correlation and rule evaluation, and interception logic (Endpoint Security AUTH decisions, network flow filtering) that stops malicious or policy-violating activity before it completes.\n\nInstrument telemetry at the OS boundary: Endpoint Security framework, Network Extensions (NEFilterDataProvider), FSEvents, IOKit, and event taps and capture data-movement signals.\n\nDesign and maintain the multi-process architecture that ties it together: launchd-managed daemon and agents, XPC protocols between components, code-signing-based peer authentication, and safe handling of untrusted input inside a privileged process.\n\nHarden the agent against tamper, bypass, and evasion using self-protection, integrity validation, and update-chain security.\n\nHold sensor CPU, memory, and I/O inside strict budgets while processing thousands of events per second including hard real-time constraints like ES auth deadlines, profile hot paths, and eliminate regressions before they ship.\n\nBuild test harnesses and automated regression coverage, including VM-based end-to-end testing that exercises real OS mechanisms.\n\nDrive high-severity customer escalations to root cause crashes, hangs, performance regressions, missed detections, permission and deployment failures at the code and OS-internals level, and convert escalation patterns into permanent fixes.\n\nPartner with the security research, AI, platform, and product teams to feed sensor signals into on-device ML classification, intent-aware policy enforcement, just-in-time interventions, and investigation timelines.\n\nReview code, mentor engineers, document design decisions, and share ownership of agent release quality and on-call.\n\nWhat You’ll Bring\nMust-haves\n10+ years designing, building, and delivering production native systems software (Swift, C, C++, or Objective-C), a substantial portion of it in endpoint security, OS internals, or comparable performance-critical code with strong, current Swift, including modern concurrency (actors, Sendable, structured concurrency).\n\nDeep working knowledge of macOS internals: process and thread lifecycle, memory management, file systems, code signing and entitlements, launchd, IPC (XPC and Mach primitives), and the TCC permission model.\n\nHands-on production experience with the Endpoint Security framework and/or Network Extensions, and an understanding of the system extension lifecycle that replaced kernel extensions.\n\nDemonstrated experience building or operating an EDR, EPP, XDR, DLP, or insider-risk product, or equivalent detection-and-response engineering.\n\nPractical fluency in attacker TTPs; you can reason about what an attack looks like in raw telemetry, not just in a written report.\n\nStrong low-level debugging skills: lldb, crash-dump and hang analysis, performance tracing with Instruments or equivalent.\n\nMulti-threaded and concurrent programming under load: synchronization, lock contention, race conditions, actor isolation, and object lifetime management.\n\nA track record of code running on large fleets without degrading end-user experience; you treat stability and performance as product features, and you understand enterprise deployment realities (MDM profiles, notarization, staged rollout, auto-update).\n\nScripting fluency for tooling and test automation (Python, shell, or equivalent).\n\nClear written and verbal communication with distributed teams and, when escalations demand it, directly with customers.\n\nBonus\nReverse engineering, malware analysis, or exploit and vulnerability research background.\n\nExperience shipping on-device ML inference (Core ML, ONNX Runtime, llama.cpp-class runtimes) inside a resource-constrained agent.\n\nExperience with browser extension or native-messaging integrations for telemetry capture.\n\nCross-platform endpoint agent experience (Windows or Linux sensors) alongside macOS.\n\nOur Benefits\nDistributed workplace. While we have positions we hire for in our SF office, we also hire remotely across North America.\n\nOwn a piece of the journey. Every teammate gets meaningful equity on top of their salary.\n\nWe’ve got you covered. 90% of your medical, dental, and vision is paid by Ent. We also cover 75% for your dependents.\n\nTake the time you need. Our flexible PTO lets you recharge, travel, or just take a breather.\n\nFamily matters. 12 weeks of fully paid maternity leave (birth, adoption, or foster) and 8 weeks fully paid paternity leave.\n\nLive well. A $100 monthly lifestyle account to spend on what keeps you healthy and happy - fitness, wellness, learning, and more.\n\nSet up your space. A $500 home office stipend when you join as a remote employee.\n\nDiversity & Accommodations\nWe’re committed to building a diverse, inclusive, and equitable workplace where people of all backgrounds, identities, experiences, and abilities are welcomed, valued, and supported. We recognize there is no single path to success and value nontraditional career journeys and diverse perspectives as key to building stronger, more innovative teams.\nWe strive to ensure an inclusive experience at every stage of hiring and are happy to provide reasonable accommodations. If you require accommodations or accessible formats at any point during our process, please let your recruiter know. As an equal opportunity employer, our hiring process is designed to put you at ease and help you do your best work. If there’s anything we can do to improve your experience, we’re always open to feedback.","description_format":"text","description_chars":8306,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Home office"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"},{"name":"Canada","iso":"CA","kind":"region"},{"name":"Mexico","iso":"MX","kind":"region"},{"name":"Anguilla","iso":"AI","kind":"region"},{"name":"Antigua and Barbuda","iso":"AG","kind":"region"},{"name":"Aruba","iso":"AW","kind":"region"},{"name":"Bahamas","iso":"BS","kind":"region"},{"name":"Barbados","iso":"BB","kind":"region"},{"name":"Belize","iso":"BZ","kind":"region"},{"name":"Bermuda","iso":"BM","kind":"region"},{"name":"British Virgin Islands","iso":"VG","kind":"region"},{"name":"Bonaire, Sint Eustatius and Saba","iso":"BQ","kind":"region"},{"name":"Cayman Islands","iso":"KY","kind":"region"},{"name":"Costa Rica","iso":"CR","kind":"region"},{"name":"Curaçao","iso":"CW","kind":"region"},{"name":"Dominica","iso":"DM","kind":"region"},{"name":"Dominican Republic","iso":"DO","kind":"region"},{"name":"El Salvador","iso":"SV","kind":"region"},{"name":"Greenland","iso":"GL","kind":"region"},{"name":"Grenada","iso":"GD","kind":"region"},{"name":"Guadeloupe","iso":"GP","kind":"region"},{"name":"Guatemala","iso":"GT","kind":"region"},{"name":"Haiti","iso":"HT","kind":"region"},{"name":"Honduras","iso":"HN","kind":"region"},{"name":"Jamaica","iso":"JM","kind":"region"},{"name":"Martinique","iso":"MQ","kind":"region"},{"name":"Montserrat","iso":"MS","kind":"region"},{"name":"Nicaragua","iso":"NI","kind":"region"},{"name":"Panama","iso":"PA","kind":"region"},{"name":"Puerto Rico","iso":"PR","kind":"region"},{"name":"Saint Kitts and Nevis","iso":"KN","kind":"region"},{"name":"Saint Lucia","iso":"LC","kind":"region"},{"name":"Saint Vincent and the Grenadines","iso":"VC","kind":"region"},{"name":"Saint-Pierre and Miquelon","iso":"PM","kind":"region"},{"name":"Sint Maarten","iso":"SX","kind":"region"},{"name":"Trinidad and Tobago","iso":"TT","kind":"region"},{"name":"Turks and Caicos Islands","iso":"TC","kind":"region"},{"name":"United States Virgin Islands","iso":"VI","kind":"region"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","AI Agents"],"lifecycle":[{"event":"open","at":"2026-09-11T02:27:22Z"}],"visa":[],"liveness":{"score":23,"band":"cold","label":"Long shot","p_open":1,"p_active":0.656,"p_room":0.35,"age_days":53,"expected_fill_days":22,"reasons":["conf:0","win:tail"],"computed_at":"2026-10-28T05:59:10Z"},"pay":null,"html_url":"https://alion.io/job/ent-endpoint-engineer-edr-macos","json_url":"https://alion.io/job/ent-endpoint-engineer-edr-macos.json","meta":{"generated_at":"2026-10-28T17:20:36Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":23524,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-29T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":673402},"rest":"https://alion.io/mcp/rest/get_company?id=673402"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fent-endpoint-engineer-edr-macos"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fent-endpoint-engineer-edr-macos"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fent-endpoint-engineer-edr-macos"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ent-endpoint-engineer-edr-macos\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fent-endpoint-engineer-edr-macos"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":698897}},{"tool":"search_jobs","arguments":{"company":"ent.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":698897},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}