Senior

Concentric AI
Bengaluru, Karnataka

Apply Now

Job details

Full-time
5 days ago

Qualifications

CI/CD
Authentication
Cloud infrastructure
Rust (programming language)
Go
Kubernetes
C#
Test automation
Objective-C
Windows
.NET
Microservices
OS Kernels
C++
C
Continuous integration
UX
APIs
Linux
Swift
Python
Intune
VPN

Full job description

We are building a cross-platform endpoint agent platform for enterprise data security. You will join the Endpoint Agent Services team, which owns the user-space management agent that runs continuously on every managed device. This agent is responsible for authentication, policy sync, telemetry, self-update, health monitoring, local coordination, and user notifications across macOS and Windows fleets.

Apply Here

This role is focused on the user-space endpoint agent/service, not kernel drivers or interception layers. The agent coordinates with native enforcement components and cloud services, but the candidate does not need to build macOS Network Extensions, Windows WFP/MiniFilter drivers, or packet/file-system interception components. We are prioritizing engineers who have built reliable endpoint agents, desktop services, device-management clients, security clients, VPN/ZTNA/SASE clients, MDM/UEM agents, or observability agents that operate safely at fleet scale.

Experience of years: 5 to 12 years

What You'll Do:

Design and build the core endpoint agent service, running as a privileged background daemon/service on macOS and Windows
Implement device and user authentication flows (e.g., mTLS, OAuth/OIDC device flows, certificate-based identity) between the endpoint and cloud services
Build the policy client: fetching, caching, versioning, and safely applying policies from the backend, with rollback and offline-resilience support
Own telemetry pipelines: structured event collection, batching, local buffering, and reliable upload with backpressure handling
Build the self-update mechanism for the endpoint agent, including staged rollout, signature verification, rollback-on-failure, and safe recovery from partial updates
Implement health-check and watchdog logic — detecting crashed or hung components, restarting services when safe, and reporting endpoint health upstream
Design local IPC/RPC interfaces that allow the user-space agent to coordinate cleanly with native macOS and Windows components
Build the notification/UI surface layer (system tray, native notification APIs) for policy prompts, block notices, and user consent flows
Coordinate with native enforcement components and cloud services to manage device identity, local trust anchors, proxy credentials, and policy-driven behavior
Collaborate closely with macOS, Windows, backend, proxy, and security teams to define stable cross-component contracts
Contribute to architecture decisions around resilience, tamper-resistance, minimal privilege, and performance (CPU/memory footprint on constrained enterprise laptops)
Participate in incident response and root-cause analysis for production fleet issues
Mentor engineers, review designs/code, and (at Staff level) drive technical strategy across the service team

Required Qualifications:

6+ years (Senior) / 9+ years (Staff) of professional software engineering experience
Strong experience building endpoint agents, desktop services, device-management clients, security clients, VPN/ZTNA/SASE clients, MDM/UEM agents, or observability agents — you understand fleet heterogeneity, service lifecycle management, tamper resistance, low-resource operation, and the operational realities of running software on end-user machines
Proven experience building long-running user-space background services/daemons on macOS and/or Windows, including launchd/LaunchDaemon/LaunchAgent, Windows Services, service lifecycle management, and safe recovery patterns, in any systems language such as Go, C++, Rust, C#, or Swift
Experience with secure authentication/identity patterns: OAuth2/OIDC, mTLS client auth, token refresh/rotation, secure credential storage (Keychain/DPAPI/Credential Manager)
Experience designing systems for reliability under adverse conditions: intermittent connectivity, partial failures, crash recovery, safe rollback
Solid grasp of concurrency and resource lifecycle management in your primary language — this runs on end-user machines, so leaks and runaway CPU/memory are unacceptable
Experience shipping and operating auto-update systems with cryptographic signature verification
Familiarity with observability: structured logging, metrics, tracing, and building telemetry pipelines with local buffering/backpressure
Security mindset: comfortable reasoning about attack surface, tamper resistance, privilege separation, and secure-by-default design — this is security-adjacent software running with elevated privileges
Strong cross-team collaboration skills — this role sits at the intersection of endpoint platform, native OS, backend, proxy, and security teams, so clear API/contract design and communication matter as much as code

Strongly Preferred:

Production experience writing Go, or strong willingness/aptitude to adopt it as the team’s primary language
Experience with DLP, EDR, XDR, VPN, ZTNA, SASE, secure web gateway, MDM/UEM, or endpoint observability products
Experience with code signing, notarization (macOS), and Authenticode (Windows) for shipping privileged binaries
Familiarity with remote/forward-proxy architectures (e.g., Envoy) and how an endpoint agent coordinates with a remote proxy for traffic redirection, CA trust distribution, and proxy authentication
Familiarity with macOS Network Extension or Windows WFP/MiniFilter internals is helpful, but this role does not require owning kernel drivers or interception layers
Experience with policy-as-data systems — versioned policy schemas, safe migration, staged/canary rollout of policy changes
Familiarity with enterprise device management concepts (MDM profiles, Intune/Jamf integration, compliance reporting)
Experience building native OS notification UX (menu bar apps, system tray apps) — often via cgo/Objective-C bridges on macOS or Windows syscall/COM interop

What Success Looks Like in 6–12 Months:

The user-space endpoint agent reliably authenticates, fetches policy, updates itself, and reports telemetry across a large, heterogeneous fleet with minimal support escalations
Clean, versioned contracts exist between the endpoint agent, native macOS/Windows components, backend services, and proxy services, reducing cross-team friction
Self-update and rollback have been proven safe in production with zero fleet-bricking incidents
CPU/memory footprint stays within agreed budgets on low-end enterprise hardware

Notice: Concentric AI never asks for money nor paid certifications during the interview process; such behavior is a known scam of which we’ve been made aware.

Other positions

View All

Test Automation Engineer (Full-Time)

Bengaluru & Pune

The ideal candidate is a Python expert with hands-on experience in automation frameworks, CI/CD, and Linux systems. This role requires a strong understanding of microservices and Kubernetes, with exposure to cloud infrastructure and system-level automation.

Learn More

Principal Engineer — Cloud Data Plane & Traffic Processing

We are building the inline cloud data plane that powers a next-generation AI security platform. This service terminates TLS, inspects and processes enterprise AI traffic in real time, and applies policy, classification, orchestration, auditing, and analytics — at millisecond latencies under production SaaS load across multiple global regions.