SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Ent is an intent-aware workspace security platform protecting human and AI-driven work. The company was founded by the co-founders of RiskIQ (acquired by Microsoft) and the team behind Microsoft Security Copilot. Ent is in production with Global 2000 customers across hospitality, financial services, and defense, backed by top-tier investors including Sequoia and In-Q-Tel.
As an Endpoint Engineer, you will own core components of Ent's lightweight agent that runs across Windows, macOS, and Linux. This role is critical to the platform—every Ent capability ships on this agent, including collection, policy evaluation, enforcement, transport, and lifecycle machinery. You will be measured on the things customers only notice when they break: installs, updates, offline behavior, and resource footprint on machines you cannot log into.
Key responsibilities include:
- Build and own agent components across multiple platforms: collection, enrichment, policy evaluation, enforcement, IPC, local storage, and cloud transport
- Deliver features end-to-end: design, implementation, tests, telemetry, staged rollout, and post-release monitoring
- Own agent lifecycle engineering: packaging and installers (MSI, PKG, DEB/RPM), enrollment, configuration delivery, safe staged self-update, rollback, and clean uninstall
- Enforce strict performance budgets (CPU, memory, disk, network) and catch regressions in CI
- Implement offline and degraded-mode behavior: local queueing, backpressure, policy caching, retry semantics, and edge case handling
- Apply secure engineering fundamentals in privileged processes: least privilege, signed updates, secrets handling, safe parsing
- Build diagnostics, log collection, health reporting, and support tooling for field troubleshooting
- Own test infrastructure: unit/integration tests, cross-platform CI, OS-version matrices, upgrade/downgrade paths, soak and performance testing
- Integrate agent signals with backend services and browser extension; manage API and schema evolution
- Handle escalations across the stack and contribute to code review, design review, and on-call rotation
Required qualifications:
- 5+ years building production software in C/C++ or Swift, including native desktop or endpoint software
- Working knowledge of OS internals and system APIs on Windows, macOS, or Linux
- Experience with unattended software on machines you don't control: versioning, upgrades, backward compatibility, failure recovery
- Strong grasp of concurrency, memory management, and empirical performance measurement
- Debugging discipline and ability to reproduce, instrument, and prove root cause
- Comfort with build systems, cross-platform CI/CD, test automation (CMake/Bazel, GitHub Actions), and Python scripting
- Security-conscious coding habits and awareness of endpoint software as attack surface
- Clear communication and effective collaboration in distributed teams
Bonus experience includes endpoint security (EDR, DLP, EPP, MDM), kernel extensions, eBPF, ETW, macOS Endpoint Security Framework, enterprise deployment tools (Intune, Jamf, SCCM), and code signing/notarization pipelines.
