Principal Engineer – CPU Hardware Telemetry & Silicon Security

Cyble is seeking a Principal Engineer to build production-grade CPU hardware telemetry collection for its endpoint protection initiative. The role focuses on extracting and analyzing processor-level signals across Intel and AMD CPUs, developing low-level collectors for Windows and Linux, and integrating telemetry into real-time threat detection.

Responsibilities:

• Design and implement high-performance telemetry collection using CPU Performance Monitoring Units (PMUs)
• Work with hardware performance counters (HPCs), architectural and model-specific events, and low-level processor instrumentation
• Develop collection capabilities leveraging:
  • Intel Performance Monitoring Counters (PMCs)
  • Intel Precise Event-Based Sampling (PEBS)
  • Intel Processor Trace (Intel PT)
  • Intel Last Branch Records (LBR)
  • AMD Instruction-Based Sampling (IBS)
  • AMD Performance Monitoring Counters
  • Model-Specific Registers (MSRs)
• Identify and characterize hardware events relevant to malware execution, ransomware, privilege escalation, exploitation, and other suspicious behaviors
• Implement adaptive sampling, counter multiplexing, and efficient collection across CPU generations
• Develop low-level telemetry collectors for Windows and Linux operating systems
• Implement kernel-mode components, drivers, and privileged user-space services where appropriate
• Work with Linux perf_events, eBPF, Windows kernel interfaces, and native operating-system profiling capabilities
• Optimize sampling frequency, latency, CPU utilization, memory consumption, and system stability
• Ensure telemetry collection operates safely in production without materially affecting endpoint performance
• Design robust handling for processor-specific differences, unsupported events, permissions, and firmware configurations
• Collaborate with security researchers and machine learning engineers to transform raw hardware telemetry into actionable behavioral signals
• Investigate how CPU execution patterns, branch behavior, cache activity, instruction retirement, and memory-access characteristics can help distinguish benign activity from malicious execution
• Develop reliable feature-extraction pipelines suitable for real-time detection models
• Evaluate signal robustness against workload changes, environmental noise, and adversarial evasion
• Help establish measurable detection accuracy, false-positive rates, and performance benchmarks
• Build a deep understanding of AMD and Intel processor microarchitectures and their hardware event models
• Evaluate telemetry fidelity across processor generations and operating environments
• Investigate differences between bare-metal and virtualized environments, including counter availability, sampling behavior, and measurement distortion
• Develop methods for validating and calibrating hardware telemetry across different hardware configurations
• Work with engineering and ecosystem partners on hardware compatibility, performance optimization, and deployment readiness
• Build scalable, fault-tolerant telemetry collection components suitable for deployment across enterprise endpoints
• Develop benchmarking, validation, profiling, and diagnostic tools
• Maintain comprehensive testing across different CPUs, operating systems, and workload profiles
• Collaborate with Cyble Titan engineering teams to integrate hardware telemetry into endpoint detection and response workflows
• Contribute to technical architecture, design reviews, engineering standards, and intellectual property development

Requirements:

• 8+ years of experience in low-level systems programming, CPU performance engineering, kernel development, processor architecture, or related fields
• Deep understanding of x86-64 CPU microarchitecture, preferably across Intel and AMD processors
• Strong practical experience working with CPU PMUs, hardware performance counters, or processor profiling systems
• Advanced proficiency in C/C++ and experience developing performance-sensitive systems software
• Strong understanding of operating-system internals, kernel/user-mode boundaries, interrupts, scheduling, memory management, and concurrency
• Practical experience with hardware telemetry, event-based sampling, tracing, or low-level instrumentation
• Experience diagnosing hardware counter behavior and performance measurement inaccuracies
• Ability to interpret processor documentation, performance event specifications, and microarchitectural reference manuals
• Strong debugging, performance optimization, and engineering problem-solving skills
• We are particularly interested in candidates who have personally built hardware telemetry collection systems, rather than only consumed telemetry through existing profiling tools
• Previous engineering experience at Intel, AMD, or a company working extensively with processor performance monitoring
• Experience developing CPU profiling tools, performance analysis frameworks, or processor observability infrastructure
• Knowledge of Intel PEBS, Intel PT, LBR, AMD IBS, and vendor-specific performance events
• Experience with Windows kernel drivers, Linux kernel modules, perf_events, eBPF, or ETW
• Familiarity with hypervisors, virtual machine execution, and hardware counter virtualization
• Experience with Rust, assembly language, or low-level instruction-set programming
• Familiarity with processor power states, CPU topology, SMT, and heterogeneous cores
• Background in endpoint security, EDR, malware analysis, or behavioral detection
• Experience integrating real-time telemetry with machine learning systems
• Contributions to operating-system kernels, profiling tools, processor instrumentation, or related open-source projects