Endpoint Engineer, Data Security

Ent is the intent-aware workspace security platform for securing human and AI-driven work. Built to protect productivity, the new attack surface, Ent understands not just what users and agents do but why, and intervenes at the moment of risk before incidents occur. Where existing tools see events, Ent sees intent, so security teams can step in at the moment of risk instead of investigating days later. Founded by Lou Manousos and Brandon Dixon, co-founders of RiskIQ (acquired by Microsoft) and the team behind Microsoft Security Copilot, Ent is in production with Global 2000 customers across hospitality, financial services, and defense, and backed by Decibel, Sequoia, Crosspoint Capital, Craft Ventures, Shield Capital, Felicis, and In-Q-Tel. We’re now hiring the team that will define this category., We are seeking an Endpoint Engineer to be part of the team that owns Ent’s data protection layer on the device: classifying sensitive data, tracing how it moves, and enforcing policy at the moment of egress - including to AI tools and agents. This role pairs classic content inspection with Ent’s on-device small language model, so enforcement reflects what a person is trying to do and not only what a file contains. Precision is the product here., * Build the endpoint data-protection layer of the Ent agent: classify sensitive data on the device, trace how it is created and moved, and enforce policy at the moment of egress.

• Instrument and control the full set of exfiltration channels - removable media and USB, printing, clipboard, drag-and-drop, screen capture, network shares, Bluetooth and AirDrop, email, web and browser upload, sync clients, and AI tools and agents including chat interfaces, IDE assistants, and CLI agents.
• Implement on-device content inspection and classification: regular expression and pattern matching, keyword and dictionary matching, exact and indexed document matching, fingerprinting, file-type and structure identification, and OCR for image-borne content.
• Integrate Ent’s on-device small language model into classification and intent decisions so enforcement reflects what the user is trying to do, not only what a file contains.
• Build data lineage and provenance tracking that keeps classification attached to content as it is copied, renamed, transformed, archived, compressed, or re-encoded.
• Implement or work with team members to the interception plumbing that makes the above possible: Windows minifilters and ETW, macOS Endpoint Security Framework and Network Extensions, Linux fanotify and eBPF, and browser extension hooks.
• Drive precision as a first-class metric: build labeled corpora, measure false-positive and false-negative rates per detector, and tune classification quality with evidence.
• Keep inspection cost invisible to the user - budget CPU, memory, and I/O for content scanning, and never block, delay, or corrupt legitimate user files and workflows.
• Produce forensically useful incident evidence - who, what data, which channel, what intent - that feeds investigation timelines, insider-risk review, and compliance reporting.
• Own customer escalations on missed egress paths, and application-compatibility conflicts, and turn recurring patterns into permanent fixes.
• Partner with product, security research, AI, and compliance stakeholders to map endpoint controls to regulatory regimes such as GDPR, HIPAA, PCI DSS, CCPA, and export-control requirements.

• 5+ years shipping production systems software in C/C++, including work on an endpoint agent deployed at enterprise scale.
• Direct experience building or operating an endpoint for insider-risk, data-security, or CASB/SASE data-protection product.
• Strong operating system internals knowledge on at least one platform: file system filtering, process and handle interception, and the user/kernel boundary.
• Hands-on content inspection and data classification work: pattern-based detection, fingerprinting and hashing schemes, file format parsing, and handling of archives and Office/PDF container formats.
• Experience controlling device and network egress channels - USB and removable media, print, clipboard, HTTPS upload.
• Multi-threaded, performance-sensitive engineering against measured latency and throughput budgets.
• Strong debugging and profiling skills on real user machines, including application-compatibility investigations where the security agent is suspected first.
• A precision mindset: you understand that a noisy product gets disabled, and you instrument accordingly.
• Clear written and verbal communication with distributed teams and customer-facing stakeholders., * OCR, ML-based classification, or embedding and LLM-based content understanding applied to data protection.
• Implementation experience with data lineage or provenance tracking.
• Cross-platform development spanning Windows and macOS (Linux a plus), and browser extension development.
• Encryption, rights management, or key handling on the endpoint.
• Depth in regulatory compliance and audit-evidence design.
• Insider-threat investigation workflows, or data governance for AI tools and autonomous agents.

• Distributed workplace. While we have positions we hire for in our SF office, we also hire remotely across North America.
• Own a piece of the journey. Every teammate gets meaningful equity on top of their salary.
• We’ve got you covered. 90% of your medical, dental, and vision is paid by Ent. We also cover 75% for your dependents.
• Take the time you need. Our flexible PTO lets you recharge, travel, or just take a breather.
• Family matters. 12 weeks of fully paid maternity leave (birth, adoption, or foster) and 8 weeks fully paid paternity leave.
• Live well. A $100 monthly lifestyle account to spend on what keeps you healthy and happy - fitness, wellness, learning, and more.
• Set up your space. A $500 home office stipend when you join as a remote employee.