Endpoint Engineer, Data Security

Role overview

Build the on-device data protection layer of a workspace security agent focused on understanding user and AI intent. This engineer classifies sensitive content, traces how it moves, and enforces policy at the moment of egress — including to AI tools and autonomous agents — pairing classic content inspection with an on-device small language model so enforcement reflects intent, not just file contents.

Responsibilities

- Build the endpoint data-protection layer: classify sensitive data on the device, trace its creation and movement, and enforce policy at egress. - Instrument and control exfiltration channels including removable media and USB, printing, clipboard, drag-and-drop, screen capture, network shares, Bluetooth and AirDrop, email, web upload, sync clients, and AI tools and agents. - Implement on-device content inspection: regex and pattern matching, keyword and dictionary matching, document fingerprinting, file-type identification, and OCR for image-borne content. - Integrate an on-device small language model into classification and intent decisions. - Build data lineage and provenance tracking that keeps classification attached as content is copied, renamed, transformed, archived, compressed, or re-encoded. - Drive precision as a first-class metric: build labeled corpora, measure false-positive and false-negative rates per detector, and tune quality with evidence.

Requirements

- 5+ years shipping production systems software in C/C++, including endpoint agent work deployed at enterprise scale. - Threaded, performance-sensitive engineering against measured latency and throughput budgets. - Strong debugging and profiling skills on real user machines, including application-compatibility investigations. - A precision mindset: understanding that a noisy product gets disabled, and instrumenting accordingly. - Clear written and verbal communication with distributed teams and customer-facing stakeholders.

Nice to have

- OCR, ML-based classification, or embedding and LLM-based content understanding applied to data protection. - Implementation experience with data lineage or provenance tracking. - Cross-platform development spanning Windows and macOS, with Linux a plus, and browser extension development. - Encryption, rights management, or key handling on the endpoint. - Depth in regulatory compliance and audit-evidence design (GDPR, HIPAA, PCI DSS, CCPA).

Benefits and work setup

- Distributed workplace with remote hiring across North America and a San Francisco office option. - Meaningful equity on top of salary. - 90% employer coverage of medical, dental, and vision premiums; 75% for dependents. - Flexible PTO, 12 weeks paid parental leave for birth, adoption, or foster placements, and a $100 monthly lifestyle account. - $500 home office stipend for remote hires.