SISA Information Security - Senior Software Engineer - Endpoint Detection & Response

About The Role : We're hiring a Senior Software Engineer to build and maintain the core of our endpoint security agent the core runtime and its pluggable security-module framework, built entirely in Go along with the on-premise management and telemetry-relay components it communicates with over gRPC. You'll also work on the kernel-level components that hook into the OS, which are written in C/C++ as is standard for driver-level development. This is a deeply hands-on systems engineering role, working close to the OS, network stack, kernel-level hooks, and security primitives (mTLS, certificates, secure channels). Key Responsibilities : - Design and implement features across the core agent runtime and its pluggable security-module framework, entirely in Go. - Develop and maintain kernel-level components (e.g., Windows kernel drivers/minifilters, Linux kernel modules/eBPF) used for real-time monitoring, hooking, or enforcement, ensuring they are stable and don't destabilize the host OS. - Build and maintain gRPC services/clients for the control-plane channel between the agent and its on-premise management component, and the data-plane channel to the telemetry relay component. - Implement mTLS-based authentication, certificate handling, and secure channel setup at the agent level. - Build reliable local buffering/queuing (e.g., disk-backed queue, WAL) so telemetry survives relay or network downtime without data loss. - Implement security-module binary distribution, independent versioning, staged/canary rollout, and rollback mechanisms. - Design for resource efficiency CPU, RAM, disk, network so multiple security modules can run concurrently on constrained endpoints without degrading host performance. - Build failure isolation between the core agent runtime and individual security modules so one module crashing doesn't take down the whole agent. - Debug and optimize performance and stability issues across Windows and/or Linux endpoints in production environments. - Collaborate with the architect on protocol/version compatibility matrices; author and maintain Protobuf schemas. - Write unit and integration tests, participate in code reviews, and contribute to CI/CD pipelines for agent releases. Required Technical Skills : - 8 to 10 years of hands-on software engineering experience with a strong systems-level programming background. - Strong, genuinely hands-on proficiency in Go the agent runtime and its modules are built entirely in Go this role is code-first, not just familiar-with-the-syntax. - Hands-on experience writing and debugging kernel-level code in C/C++ (e.g., Windows kernel drivers/minifilters/WFP, or Linux kernel modules/eBPF) this is a core requirement, not a nice-to-have, given the agent's need for OS-level hooks that can't be implemented in Go. - Solid understanding of gRPC/Protocol Buffers, HTTP/2 streaming, and core networking fundamentals (TCP/IP, TLS/mTLS). - Experience building agent/daemon software that runs persistently on endpoints (Windows and/or Linux) service lifecycle, background processes, auto-update mechanisms. - Comfortable with concurrent/multi-threaded programming and designing for resource-constrained environments. - Experience implementing local data persistence or buffering for reliability under network interruption (disk-backed queues, write-ahead logs, or similar). - Understanding of certificate-based authentication and secure communication design at the implementation level. Preferred / Nice To Have : - Experience in EDR/XDR, antivirus, or other endpoint security agent development. - Exposure to active security-testing or breach-and-attack simulation style tool internals. - Experience with cross-platform agent development (Windows/Linux/macOS). - Familiarity with PCI-DSS or other compliance-driven engineering practices. - Experience with observability tooling (Prometheus, OpenTelemetry, or similar) for on-prem/distributed components. What Success Looks Like In This Role : - Security-module binaries that upgrade cleanly and roll back safely without fleet-wide incidents. - An agent that degrades gracefully buffering and reconnecting rather than losing data during network interruptions. - Kernel-level code that is stable enough to run on production endpoints without causing crashes or performance regressions. Education : - Bachelor's degree in Computer Science, Engineering, or a related field. - Equivalent hands-on experience will be given full weight over formal qualifications.