Staff Software Development Engineer – Linux Endpoint

BeyondTrust is the global identity security leader protecting Paths to Privilege™. As a Staff Software Development Engineer, you'll be responsible for the Linux kernel authority for the runtime enforcement layer of the Identity Security Platform, designing and building eBPF programs and managing kernel/userspace enforcement boundaries.

Responsibilities:

• Design, build, and own our eBPF programs and BPF LSM hooks (bprm_check_security, file_open, socket_connect). You'll enforce policy synchronously in the kernel by returning -EPERM to block, rather than logging after the fact, and you'll build the userspace agent that loads and drives them
• Own the kernel/userspace enforcement boundary: kernel-side event capture over ring buffers, policy evaluation in userspace, and deny decisions pushed back into the kernel as hash-keyed caches so subsequent hits block inline
• Drive down enforce-mode latency on the syscall hot path as we scale across large fleets. That means process enrichment, binary-hash caching and eviction under heavy fork/exec pressure, and process-ancestry resolution
• Extend enforcement into containers and namespaces: cgroup- and namespace-aware policy, container identity on kernel events, Kubernetes workloads. Most of this is greenfield, and it sits at the center of the role
• Harden portability across kernel versions and distributions so enforcement loads and behaves correctly on the kernels customers actually run. You'll work with BTF-driven struct-offset discovery, LSM availability detection, tracepoint-ABI drift, and graceful fallback
• Partner with the macOS and Windows enforcement engineers and the policy-backend team on the shared plane: policy semantics, cross-stack conformance, event schema, the common Rust agent. You'll represent Linux in cross-org architecture reviews
• Read requirements to find gaps and risks, propose simplifications, and explain tradeoffs to technical and non-technical stakeholders
• Raise the engineering bar. You'll take end-to-end ownership from design through production, and you'll carry extra weight where a kernel bug means a wrong security decision instead of just a crash
• Mentor senior and mid-level engineers on Linux systems and eBPF craft

Requirements:

• Deep Linux kernel internals - scheduling, memory management, the networking stack, syscalls, the LSM framework - backed by production systems programming in C, Rust, or both
• Hands-on eBPF for security enforcement, with real comfort at the verifier level. You can write programs that pass BPF_PROG_LOAD across kernel versions and reason about the stack limit, bounded loops, and helper-behavior differences. We write our BPF in Rust (aya / aya-ebpf, no_std). Any eBPF stack transfers - libbpf, BCC, Cilium eBPF, aya - but verifier fluency is non-negotiable
• BTF and CO-RE, plus the practical realities of portability: task_struct layout drift, LSM config availability, tracepoint ABI
• Container runtime internals - namespaces, cgroups, seccomp - and how they intersect with kernel-level security tooling
• Kernel debugging and performance tooling: perf, ftrace, bpftrace, gdb/kgdb, crash-dump analysis
• 8+ years in systems-level software engineering, with real depth in Linux kernel development and eBPF
• Demonstrated AI-first development. We build this platform through agentic tooling. AI-driven design exploration, code generation, adversarial plan review, and automated pre-merge quality gates are how work ships here, not a side experiment. You use Claude Code or a comparable tool as a core part of your daily workflow, and you can speak concretely to how it raises both your velocity and your rigor. That matters most in correctness- and security-critical kernel code, where you have to know exactly when to stop and verify by hand
• A working grasp of systems design patterns and their tradeoffs at the kernel/userspace boundary
• Full-lifecycle experience, including product release, in an agile environment
• A track record of technical leadership on complex, ambiguous initiatives that span teams