Staff Software Development Engineer, BeyondTrust
Identity and access security platform
Open for applications
Identity and access security platform
1001+ employees
Open for applications
1001+ employees
Company mission
To empower organizations with the most effective solution to manage the entire identity attack surface and neutralize threats, whether from external attacks or insiders.
Role
Who you are
- This is a Linux specialist role, so the depth requirements are real:
- Deep Linux kernel internals - scheduling, memory management, the networking stack, syscalls, the LSM framework - backed by production systems programming in C, Rust, or both
- Hands-on eBPF for security enforcement, with real comfort at the verifier level. You can write programs that pass BPF_PROG_LOAD across kernel versions and reason about the stack limit, bounded loops, and helper-behavior differences. We write our BPF in Rust (aya / aya-ebpf, no_std). Any eBPF stack transfers - libbpf, BCC, Cilium eBPF, aya - but verifier fluency is non-negotiable
- BTF and CO-RE, plus the practical realities of portability: task_struct layout drift, LSM config availability, tracepoint ABI
- Container runtime internals - namespaces, cgroups, seccomp - and how they intersect with kernel-level security tooling
- Kernel debugging and performance tooling: perf, ftrace, bpftrace, gdb/kgdb, crash-dump analysis
- 8+ years in systems-level software engineering, with real depth in Linux kernel development and eBPF
- Demonstrated AI-first development. We build this platform through agentic tooling. AI-driven design exploration, code generation, adversarial plan review, and automated pre-merge quality gates are how work ships here, not a side experiment. You use Claude Code or a comparable tool as a core part of your daily workflow, and you can speak concretely to how it raises both your velocity and your rigor. That matters most in correctness- and security-critical kernel code, where you have to know exactly when to stop and verify by hand
- A working grasp of systems design patterns and their tradeoffs at the kernel/userspace boundary
- Full-lifecycle experience, including product release, in an agile environment
- A track record of technical leadership on complex, ambiguous initiatives that span teams
- You share successes and failures openly, and you work well with people. You adapt when the situation and the requirements shift. You fix issues before anyone assigns them to you, and you stay persistent through roadblocks, pulling in others when you need to
- You hold a high bar and push your teams to ship reliable systems, especially where a kernel bug carries outsized risk. You know systems software best practices, from rigorous testing to sharp peer review to architecture that survives contact with production
- You reach for AI tools to move faster and think more clearly, and you keep the judgment to slow down and verify by hand when the code demands it. You weigh speed against risk and decide from data
- You feel the weight of enforcement code. You'd rather ship a correct block a day late than a wrong one now, and you choose your failure modes - fail-open or fail-closed - on purpose instead of by accident
What the job involves
- As Staff Software Development Engineer, you'll be the Linux kernel authority for the runtime enforcement layer of our Identity Security Platform. These components decide, in-kernel, whether to permit or deny each action an identity or AI agent attempts on a Linux endpoint
- You'll set the technical direction for eBPF enforcement on Linux and own it end to end. That means hooks that make the right call in real time, across the fleet, without breaking legitimate workloads. Peer engineers own the macOS and Windows enforcement surfaces. You share one policy language, one event schema, and one userspace agent with them, but Linux kernel-space is yours
- You know this layer better than anyone. You want your code to be the thing that stops a compromised credential or a runaway AI coding agent before it impacts production
- Design, build, and own our eBPF programs and BPF LSM hooks (bprm_check_security, file_open, socket_connect). You'll enforce policy synchronously in the kernel by returning -EPERM to block, rather than logging after the fact, and you'll build the userspace agent that loads and drives them
- Own the kernel/userspace enforcement boundary: kernel-side event capture over ring buffers, policy evaluation in userspace, and deny decisions pushed back into the kernel as hash-keyed caches so subsequent hits block inline
- Drive down enforce-mode latency on the syscall hot path as we scale across large fleets. That means process enrichment, binary-hash caching and eviction under heavy fork/exec pressure, and process-ancestry resolution
- Extend enforcement into containers and namespaces: cgroup- and namespace-aware policy, container identity on kernel events, Kubernetes workloads. Most of this is greenfield, and it sits at the center of the role
- Harden portability across kernel versions and distributions so enforcement loads and behaves correctly on the kernels customers actually run. You'll work with BTF-driven struct-offset discovery, LSM availability detection, tracepoint-ABI drift, and graceful fallback
- Partner with the macOS and Windows enforcement engineers and the policy-backend team on the shared plane: policy semantics, cross-stack conformance, event schema, the common Rust agent. You'll represent Linux in cross-org architecture reviews
- Read requirements to find gaps and risks, propose simplifications, and explain tradeoffs to technical and non-technical stakeholders
- Raise the engineering bar. You'll take end-to-end ownership from design through production, and you'll carry extra weight where a kernel bug means a wrong security decision instead of just a crash
- Mentor senior and mid-level engineers on Linux systems and eBPF craft
Our take
Unifying in-office and remote terminals with secure authorization, BeyondTrust is meeting the changing demands of identity security with new technology. Though it was founded in 1985, BeyondTrust modernized its systems with a new software platform in 2022, that better suits the security needs of remote work and hybrid employee structure.
This modernization speaks volumes about the direction of BeyondTrust, which was acquired by management platform Bomgar in 2018. With a focus on cloud technology, the company has successfully adapted to the ever-changing shape of cyber security threats and continues to nurture a large client base.
On top of record growth in 2022, the company continues to introduce new features and capabilities to its platform, demonstrating a commitment to innovation that bodes well for its future performance. It has also become a strong voice in the movement for better cybersecurity practices in business, conducting surveys and research into the evolving space.
Steph
Company Specialist at Welcome to the Jungle
Insights
11% employee growth in 12 months
Company
Funding (last 2 of 3 rounds)
Jan 2010
$3m
LATE VC
Jan 2009
$6m
LATE VC
Total funding: $12.1m
Company HQ
Johns Creek, GA
Leadership
Janine Seebeck
(CEO)Janine has been as BeyondTrust since 2016, joining as CFO, they then moved into the role of COO in 2020 and CEO in 2022. Prior to BeyondTrust, they spent 5 years at Agilysys as a VP Controller and CFO.
Marc Maiffret
(CTO)Marc previously spent over 10 years at eEye Digital Security, joining in 1999 as Chief Hacking Officer and moving into the role of CTO in 2006. They held this role they held until the company was acquired by BeyondTrust in 2012, where they then became the CTO of BeyondTrust.
Brent Thurrell
(CRO)Brent joined BeyondTrust in 2012 as an SVP International, moving into the role of CRO in 2020. Previously, they founded Scholabo, served as the Head of Sales at Pirean, and served as a Director of Sales EMEA at Aveksa.
Mike Puterbaugh
(CMO)Mike joined BeyondTrust in 2024 as an SVP of Product & Influencer Marketing, moving into the role of CMO in 2025. Prior to this, they were the CMO at Pathlock and Ziflow.
Share this job
View 19 more jobs at BeyondTrust