SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
CrowdStrike's Content Development team within Endpoint Protection is seeking an Engineer III to research and develop detection techniques for malicious activity on Linux systems, then build them into production-level solutions for the Falcon Sensor platform. This role combines research and implementation, working with a small team of Linux engineers while leveraging shared code across Windows, macOS, and Linux sensor platforms.
You will design and build detection logic and systems to identify cyber attackers and stop breaches. The work involves researching detection techniques (including reverse engineering and big-data analysis), owning features from design through delivery, and applying engineering best practices—secure coding, testing, debugging, performance optimization, code reviews, and CI/CD—to ensure sensor code is fast and reliable. You'll collaborate across geographies with cross-functional teams, respond to customer-reported issues, and take ownership of individual deliverables.
The Falcon Host platform processes thousands of events per second, delivering deep visibility into endpoint operations and performing rich correlation to identify and block malicious activity. The sensor is a lightweight agent installed on client machines that observes system activity, recognizes malicious behavior, provides on-box prevention, and sends telemetry to the cloud. The cloud component aggregates sensor data across customer networks and presents prioritized threat summaries to operations teams.
Required: 3+ years of experience in either (1) reverse engineering, threat detection, and malware analysis with on-device development familiarity, or (2) designing and delivering high-quality C/C++ software with security interest/experience. Solid knowledge of Linux OS internals (processes, storage, networking, memory management). Ability to develop high-quality, high-concurrency, high-reliability C/C++ code meeting enterprise performance and standards requirements. Experience collaborating across CI, testing, debugging, performance tracing, release management, and big-data telemetry analysis. Team player who can lead, mentor, and communicate effectively in distributed teams. Proven experience using AI technologies to enhance decision-making and drive outcomes.
Bonus: Linux kernel programming and/or eBPF experience; prior endpoint threat detection or sensor development experience.
