Senior Software Engineer

Mimecast•Minneapolis, MN

23d•$148,000 - $222,000

About The Position

Incydr Product Development is looking for a Senior Software Engineer to join the Endpoint Data Protection team. Reporting to the Senior Manager - Engineering, you’ll help protect organizations from data loss and insider risk across millions of endpoints as we invest in the next generation of that protection: defending data wherever it moves, however it moves. This is a foundational role working on our endpoint sensor technology that runs continuously and reliably on millions of corporate machines across Windows, macOS, and Linux. You'll work at the lowest levels of the operating system, building kernel drivers and Endpoint Security extensions that power how Incydr detects and stops data loss and insider risk. You'll own features end to end, from early research and proof of concept through production at scale. Mimecast is an AI-First engineering organization. Our teams actively leverage AI-powered development tools across all facets of engineering, and we're looking for someone genuinely curious about working this way—including bringing that curiosity to securing the AI-driven workflows this role increasingly has to defend against.

Requirements

Deep experience building production software, including substantial work in low-level systems or endpoint development and code that runs continuously and reliably across large-scale endpoint or systems deployments.
Low-level endpoint development expertise on at least one platform: Windows kernel mode, including minifilters, drivers, WFP, and C++; or macOS Endpoint Security and Network Extension frameworks using Swift or C++.
Strong C++ fundamentals, with sound judgment about memory, concurrency, and performance trade-offs and fluency with the debugging and profiling tools this work demands.
Experience designing extensible software architectures, including library boundaries and interface contracts, with the discipline to maintain and evolve long-lived code.
A security mindset that accounts for both evasion and adversarial behavior and how authorized users move data. This is insider risk, not just external attackers.
Experience building real-time inline enforcement and deny/block paths—not just detection and telemetry—under the strict performance and stability constraints of always-on endpoint software.
Performance discipline: you build always-on software that earns its place on the endpoint and never degrades the user's experience, applying profiling, caching, and memory-management techniques.
Comfort working daily with AI coding assistants and agents, with an interest in helping secure the AI-driven workflows customers are adopting.
Cross-platform development experience across Windows, macOS, and Linux.
Network-layer monitoring experience, including user-space traffic capture, TLS-aware analysis, macOS Network Extensions, or the Windows Filtering Platform.
Exposure to data security, DLP, or content-classification concepts—or genuine eagerness to grow into the data-centric problem space, including file-activity telemetry, content hints, and egress enrichment.
Experience shipping enterprise endpoint software, including silent installation, automatic updates, multi-tenant configuration, and the operational reality of heterogeneous corporate fleets.
Production experience with Rust, or demonstrated ability and interest in working in a Rust codebase.
A background in behavioral analytics or adjacent detection domains.

Responsibilities

Design and develop core capabilities for our Windows, macOS, and Linux agents throughout the complete software development and release lifecycle.
Work at the OS boundary, building performant, reliable kernel-mode components and Endpoint Security and Network extensions that handle complex system interactions.
Build detection paths and real-time inline enforcement, moving beyond telemetry and alerting to deny/block decisions without compromising endpoint performance.
Own features end to end, from early research and proof of concept through production at scale, and integrate agent capabilities with backend and product workflows.
Build always-on components with strong observability, performance, and stability in production.
Bring an adversarial, security-first mindset to everything you build, designing components that resist evasion and treat all input as untrusted.
Collaborate with product and cloud service teams to turn discoveries into capabilities that support real-world security investigations.