Staff Software Development Engineer

Overview

Staff Software Development Engineer owning the Linux kernel runtime enforcement layer of BeyondTrust's Identity Security Platform, setting technical direction for eBPF enforcement on Linux end to end.

What you'll do

• Design, build, and own eBPF programs and BPF LSM hooks (bprm_check_security, file_open, socket_connect), enforcing policy synchronously in the kernel by returning -EPERM to block.
• Build the userspace agent that loads and drives the eBPF programs.
• Own the kernel/userspace enforcement boundary: kernel-side event capture over ring buffers, policy evaluation in userspace, and deny decisions pushed back into the kernel as hash-keyed caches.
• Drive down enforce-mode latency on the syscall hot path at large fleet scale, including process enrichment, binary-hash caching and eviction under heavy fork/exec pressure, and process-ancestry resolution.
• Extend enforcement into containers and namespaces, including cgroup- and namespace-aware policy, container identity on kernel events, and Kubernetes workloads.
• Harden portability across kernel versions and distributions, including BTF-driven struct-offset discovery, LSM availability detection, tracepoint-ABI drift, and graceful fallback.
• Partner with macOS and Windows enforcement engineers and the policy-backend team on policy semantics, cross-stack conformance, event schema, and the common Rust agent.
• Represent Linux in cross-org architecture reviews, identify gaps and risks in requirements, propose simplifications, and explain tradeoffs to technical and non-technical stakeholders.
• Raise the engineering bar, take end-to-end ownership from design through production, and mentor senior and mid-level engineers on Linux systems and eBPF.

What you'll need

• Deep Linux kernel internals (scheduling, memory management, networking stack, syscalls, LSM framework) backed by production systems programming in C, Rust, or both.
• Hands-on eBPF for security enforcement with real comfort at the verifier level, including writing programs that pass BPF_PROG_LOAD across kernel versions and reasoning about stack limit, bounded loops, and helper-behavior differences.
• Verifier fluency is non-negotiable; any eBPF stack transfers (libbpf, BCC, Cilium eBPF, aya), and the team writes BPF in Rust (aya / aya-ebpf, no_std).
• BTF and CO-RE, plus practical portability realities: task_struct layout drift, LSM config availability, tracepoint ABI.
• Container runtime internals (namespaces, cgroups, seccomp) and how they intersect with kernel-level security tooling.
• Kernel debugging and performance tooling: perf, ftrace, bpftrace, gdb/kgdb, crash-dump analysis.
• 8+ years in systems-level software engineering, with real depth in Linux kernel development and eBPF.
• Demonstrated AI-first development, using Claude Code or a comparable tool as a core part of the daily workflow, with concrete ability to speak to how it raises velocity and rigor.
• Working grasp of systems design patterns and their tradeoffs at the kernel/userspace boundary.
• Full-lifecycle experience, including product release, in an agile environment.
• Track record of technical leadership on complex, ambiguous initiatives spanning teams.

Nice to have

• Not specified as preferred in the source.

Details

• Location: Remote Canada or Remote United States.