Software Development Engineer

Position: Staff Software Development Engineer
As Staff Software Development Engineer, you’ll be the Linux kernel authority for the runtime enforcement layer of our Identity Security Platform. These components decide, in-kernel, whether to permit or deny each action an identity or AI agent attempts on a Linux endpoint
You’ll set the technical direction for eBPF enforcement on Linux and own it end to end. That means hooks that make the right call in real time, across the fleet, without breaking legitimate workloads. Peer engineers own the macOS and Windows enforcement surfaces. You share one policy language, one event schema, and one userspace agent with them, but Linux kernel-space is yours
You know this layer better than anyone. You want your code to be the thing that stops a compromised credential or a runaway AI coding agent before it impacts production
Design, build, and own our eBPF programs and BPF LSM hooks (_security, , ). You’ll enforce policy synchronously in the kernel by returning
-EPERM to block, rather than logging after the fact, and you’ll build the userspace agent that loads and drives them
Own the kernel/userspace enforcement boundary: kernel-side event capture over ring buffers, policy evaluation in userspace, and deny decisions pushed back into the kernel as hash-keyed caches so subsequent hits block inline
Drive down enforce-mode latency on the syscall hot path as we scale across large fleets. That means process enrichment, binary-hash caching and eviction under heavy fork/exec pressure, and process-ancestry resolution
Extend enforcement into containers and name spaces: cgroup- and namespace-aware policy, container identity on kernel events, Kubernetes workloads. Most of this is greenfield, and it sits at the center of the role
Harden portability across kernel versions and distributions so enforcement loads and behaves correctly on the kernels customers actually run. You’ll work with BTF-driven struct-offset discovery, LSM availability detection, tracepoint-ABI drift, and graceful fallback
Partner with the macOS and Windows enforcement engineers and the policy-backend team on the shared plane: policy semantics, cross-stack conformance, event schema, the common Rust agent. You’ll represent Linux in cross-org architecture reviews
Read requirements to find gaps and risks, propose simplifications, and explain tradeoffs to technical and non-technical stakeholders
Raise the engineering bar. You’ll take end-to-end ownership from design through production, and you’ll carry extra weight where a kernel bug means a wrong security decision instead of just a crash
Mentor senior and mid-level engineers on Linux systems and eBPF craft
Deep Linux kernel internals - scheduling, memory management, the networking stack, syscalls, the LSM framework - backed by production systems programming in C, Rust, or both Hands-on eBPF for security enforcement, with real comfort at the verifier level. You can write programs that pass _LOAD across kernel versions and reason about the stack limit, bounded loops, and helper-behavior differences. We write our BPF in Rust (aya / aya-ebpf, ).

Any eBPF stack transfers - libbpf, BCC, Cilium eBPF, aya - but verifier fluency is non-negotiableA working grasp of systems design patterns and their tradeoffs at the kernel/userspace boundary

Kernel debugging and performance tooling: perf, ftrace, bpftrace, gdb/kgdb, crash-dump analysis8+ years in systems-level software engineering, with real depth in Linux kernel development and eBPFContainer runtime internals - name spaces, cgroups, seccomp - and how they intersect with kernel-level security toolingA track record of technical leadership on complex, ambiguous initiatives that span teams

Demonstrated AI-first development. We build this platform through agentic tooling.…