> Markdown version of [/jobs/ext/2735904-endpoint-engineer-data-security](https://www.wearedevelopers.com/jobs/ext/2735904-endpoint-engineer-data-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Endpoint Engineer, Data Security - **Company:** 1ST CHAPTER ENT. & SECURITY SERVICES, LLC - **Location:** United States (Remote available) - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Artificial Intelligence, Apple Mac Systems, Bluetooth, Encodings, Computer Networks, Data Governance, Software Debugging, Linux, File Systems, Microsoft Security Essentials, Microsoft Office, Pattern Recognition, PCI Data Security Standards, Regular Expressions, Screenshots, Multithreading, Data Classification, Large Language Models, Data Lineage, Multiplatform - **Published:** September 5, 2026 - **Apply:** https://startup.jobs/endpoint-engineer-data-security-ent-security-9915630 ## About the Role * 5+ years shipping production systems software in C/C++, including work on an endpoint agent deployed at enterprise scale. * Direct experience building or operating an endpoint for insider-risk, data-security, or CASB/SASE data-protection product. * Strong operating system internals knowledge on at least one platform: file system filtering, process and handle interception, and the user/kernel boundary. * Hands-on content inspection and data classification work: pattern-based detection, fingerprinting and hashing schemes, file format parsing, and handling of archives and Office/PDF container formats. * Experience controlling device and network egress channels - USB and removable media, print, clipboard, HTTPS upload. * Multi-threaded, performance-sensitive engineering against measured latency and throughput budgets. * Strong debugging and profiling skills on real user machines, including application-compatibility investigations where the security agent is suspected first. * A precision mindset: you understand that a noisy product gets disabled, and you instrument accordingly. * Clear written and verbal communication with distributed teams and customer-facing stakeholders., * OCR, ML-based classification, or embedding and LLM-based content understanding applied to data protection. * Implementation experience with data lineage or provenance tracking. * Cross-platform development spanning Windows and macOS (Linux a plus), and browser extension development. * Encryption, rights management, or key handling on the endpoint. * Depth in regulatory compliance and audit-evidence design. * Insider-threat investigation workflows, or data governance for AI tools and autonomous agents. ## Description Ent is the intent-aware workspace security platform for securing human and AI-driven work. Built to protect productivity, the new attack surface, Ent understands not just what users and agents do but why, and intervenes at the moment of risk before incidents occur. Where existing tools see events, Ent sees intent, so security teams can step in at the moment of risk instead of investigating days later. Founded by Lou Manousos and Brandon Dixon, co-founders of RiskIQ (acquired by Microsoft) and the team behind Microsoft Security Copilot, Ent is in production with Global 2000 customers across hospitality, financial services, and defense, and backed by Decibel, Sequoia, Crosspoint Capital, Craft Ventures, Shield Capital, Felicis, and In-Q-Tel. We're now hiring the team that will define this category., We are seeking an Endpoint Engineer to be part of the team that owns Ent's data protection layer on the device: classifying sensitive data, tracing how it moves, and enforcing policy at the moment of egress - including to AI tools and agents. This role pairs classic content inspection with Ent's on-device small language model, so enforcement reflects what a person is trying to do and not only what a file contains. Precision is the product here., * Build the endpoint data-protection layer of the Ent agent: classify sensitive data on the device, trace how it is created and moved, and enforce policy at the moment of egress. * Instrument and control the full set of exfiltration channels - removable media and USB, printing, clipboard, drag-and-drop, screen capture, network shares, Bluetooth and AirDrop, email, web and browser upload, sync clients, and AI tools and agents including chat interfaces, IDE assistants, and CLI agents. * Implement on-device content inspection and classification: regular expression and pattern matching, keyword and dictionary matching, exact and indexed document matching, fingerprinting, file-type and structure identification, and OCR for image-borne content. * Integrate Ent's on-device small language model into classification and intent decisions so enforcement reflects what the user is trying to do, not only what a file contains. * Build data lineage and provenance tracking that keeps classification attached to content as it is copied, renamed, transformed, archived, compressed, or re-encoded. * Implement or work with team members to the interception plumbing that makes the above possible: Windows minifilters and ETW, macOS Endpoint Security Framework and Network Extensions, Linux fanotify and eBPF, and browser extension hooks. * Drive precision as a first-class metric: build labeled corpora, measure false-positive and false-negative rates per detector, and tune classification quality with evidence. * Keep inspection cost invisible to the user - budget CPU, memory, and I/O for content scanning, and never block, delay, or corrupt legitimate user files and workflows. * Produce forensically useful incident evidence - who, what data, which channel, what intent - that feeds investigation timelines, insider-risk review, and compliance reporting. * Own customer escalations on missed egress paths, and application-compatibility conflicts, and turn recurring patterns into permanent fixes. * Partner with product, security research, AI, and compliance stakeholders to map endpoint controls to regulatory regimes such as GDPR, HIPAA, PCI DSS, CCPA, and export-control requirements. ## Related Videos - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [Building a Cross-Platform BLE Client with Kotlin Multiplatform and Kable](https://www.wearedevelopers.com/videos/100250-building-a-cross-platform-ble-client-with-kotlin-multiplatform-and-kable) - [A Brief History of Data Storage](https://www.wearedevelopers.com/videos/974-a-brief-history-of-data-storage) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker) - [The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most](https://www.wearedevelopers.com/videos/100254-the-developer-workstation-blind-spot-why-your-security-stack-can-t-see-what-matters-most) ## Related Articles - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Dev Digest 164: AI Agents, AI Blindspots and MCP security problems](https://www.wearedevelopers.com/magazine/578-dev-digest-164-ai-agents-ai-blindspots-and-mcp-security-problems) - [Dev Digest 176: Expensive Agents, Taking Over VSCode and Safer Vibe Coding](https://www.wearedevelopers.com/magazine/603-dev-digest-176-expensive-agents-taking-over-vscode-and-safer-vibe-coding) - [Dev Digest 129 - Now that's what I call private data!](https://www.wearedevelopers.com/magazine/468-dev-digest-129-now-that-s-what-i-call-private-data)