Lead Endpoint Engineer - Linux

About the role

You will be at the ground level of building Linux agent capabilities from the ground up, working alongside our existing Mac and Windows endpoint teams. As an Endpoint Engineer (Linux) at Nightfall, you will design, build, and maintain a production-grade, AI-native DLP agent for Linux - covering kernel-level event interception, userspace policy enforcement, and enterprise deployment.

What you'll do

• Design and develop data exfiltration prevention applications, kernel modules, system services, and agents on Linux
• Build and maintain mission-critical endpoint agents that monitor and enforce DLP policies across Linux distributions (Ubuntu, RHEL/CentOS, and others)
• Implement kernel-level event interception using eBPF, LSM hooks, netfilter, fanotify, or similar mechanisms to monitor file, network, and clipboard activity
• Develop userspace components that integrate with kernel subsystems and enforce policy decisions in real time
• Collaborate closely with the Mac and Windows endpoint teams to align on cross-platform agent architecture, shared policy models, and consistent DLP behaviors

What you need

• 10–18 years in software engineering
• Linux
• C++
• Go
• Docker
• C
• DLP
• Any graduate

Good to have

• EDR
• SIEM