Staff Software Development Engineer – Linux Endpoint

BeyondTrust•Toronto, ON

About The Position

As a Staff Software Development Engineer, you will be the Linux kernel authority for the runtime enforcement layer of our Identity Security Platform. These components decide, in-kernel, whether to permit or deny each action an identity or AI agent attempts on a Linux endpoint. You will set the technical direction for eBPF enforcement on Linux and own it end to end. This means creating hooks that make the right call in real time, across the fleet, without breaking legitimate workloads. You will share one policy language, one event schema, and one userspace agent with the macOS and Windows enforcement engineers, but Linux kernel-space will be your domain. You understand this layer deeply and want your code to be the first line of defense against compromised credentials or runaway AI coding agents impacting production.

Requirements

Deep Linux kernel internals - scheduling, memory management, the networking stack, syscalls, the LSM framework - backed by production systems programming in C, Rust, or both.
Hands-on eBPF for security enforcement, with real comfort at the verifier level, including writing programs that pass BPF_PROG_LOAD across kernel versions and reasoning about stack limit, bounded loops, and helper-behavior differences.
Experience with eBPF in Rust (aya / aya-ebpf, no_std).
Experience with any eBPF stack transfers (libbpf, BCC, Cilium eBPF, aya).
Verifier fluency is non-negotiable.
Experience with BTF and CO-RE, plus the practical realities of portability: task_struct layout drift, LSM config availability, tracepoint ABI.
Understanding of container runtime internals - namespaces, cgroups, seccomp - and how they intersect with kernel-level security tooling.
Experience with kernel debugging and performance tooling: perf, ftrace, bpftrace, gdb/kgdb, crash-dump analysis.
8+ years in systems-level software engineering, with real depth in Linux kernel development and eBPF.
Demonstrated AI-first development, using AI-driven design exploration, code generation, adversarial plan review, and automated pre-merge quality gates.
Proficiency with Claude Code or a comparable tool as a core part of your daily workflow.
A working grasp of systems design patterns and their tradeoffs at the kernel/userspace boundary.
Full-lifecycle experience, including product release, in an agile environment.
A track record of technical leadership on complex, ambiguous initiatives that span teams.

Responsibilities

Design, build, and own our eBPF programs and BPF LSM hooks (bprm_check_security, file_open, socket_connect).
Enforce policy synchronously in the kernel by returning -EPERM to block, rather than logging after the fact.
Build the userspace agent that loads and drives eBPF programs.
Own the kernel/userspace enforcement boundary, including kernel-side event capture over ring buffers, policy evaluation in userspace, and deny decisions pushed back into the kernel as hash-keyed caches.
Drive down enforce-mode latency on the syscall hot path as we scale across large fleets, focusing on process enrichment, binary-hash caching and eviction under heavy fork/exec pressure, and process-ancestry resolution.
Extend enforcement into containers and namespaces, including cgroup- and namespace-aware policy, container identity on kernel events, and Kubernetes workloads.
Harden portability across kernel versions and distributions by working with BTF-driven struct-offset discovery, LSM availability detection, tracepoint-drift, and graceful fallback.
Partner with macOS and Windows enforcement engineers and the policy-backend team on the shared plane: policy semantics, cross-stack conformance, event schema, and the common Rust agent.
Represent Linux in cross-org architecture reviews.
Read requirements to find gaps and risks, propose simplifications, and explain tradeoffs to technical and non-technical stakeholders.
Take end-to-end ownership from design through production, carrying extra weight where a kernel bug means a wrong security decision instead of just a crash.
Mentor senior and mid-level engineers on Linux systems and eBPF craft.