Endpoint Engineer - Linux

About the Company

Nightfall is the AI-native, unified data loss prevention and insider risk management platform that protects sensitive data across SaaS apps, GenAI tools, email, endpoint devices, and more. Backed by leading VC firms including Bain Capital Ventures and Venrock, Nightfall helps security teams automate data loss prevention and resolve violations before they become incidents.

Responsibilities

• Design and develop data exfiltration prevention applications, kernel modules, system services, and agents on Linux.
• Build and maintain mission-critical endpoint agents that monitor and enforce DLP policies across Linux distributions.
• Implement kernel-level event interception using eBPF, LSM hooks, netfilter, fanotify, or similar mechanisms.
• Develop userspace components that integrate with kernel subsystems and enforce policy decisions in real time.
• Collaborate with Mac and Windows endpoint teams to align on cross-platform agent architecture.
• Diagnose and resolve deep systems-level issues including kernel panics, race conditions, and IPC failures.
• Ensure agent reliability, upgrade safety, and minimal performance footprint.

Requirements

• 5+ years of related systems/endpoint engineering experience.
• Expertise in C/C++ for Linux systems development.
• Demonstrable experience building production agents or system-level software on Linux.
• Deep hands-on experience with eBPF (BPF CO-RE, libbpf, BCC) or Linux Security Modules (SELinux, AppArmor).
• Working knowledge of fanotify, inotify, netlink, and procfs.
• Familiarity with Linux namespaces, cgroups, and container runtimes (Docker, containerd).
• Experience with kernel-level debugging tools such as ftrace, perf, crash, or GDB.
• Ability to use reverse engineering and binary analysis techniques.

Preferred Qualifications

• Prior experience building DLP, EDR, or endpoint security products on Linux.
• Contributions to open-source Linux kernel or eBPF ecosystem projects.
• Experience with FUSE or overlayfs.
• Knowledge of Linux audit subsystem (auditd).
• Experience with XDR/EDR platforms like CrowdStrike or SentinelOne.
• Proficiency in Go for high-performance agent components.