Staff Software Development Engineer - macOS Endpoint

The Role

As Staff Software Development Engineer, you'll be the macOS authority for the runtime enforcement layer of our Identity Security Platform. These components decide whether to permit or deny each action an identity or AI agent attempts on a macOS endpoint.

You'll set the technical direction for enforcement on macOS and own it end to end. That means hooks that make the right call in real time, across the fleet, without breaking legitimate workloads. Peer engineers own the Linux and Windows enforcement surfaces. You share one policy language, one event schema, and one userspace agent with them, but macOS is yours.

You know this layer better than anyone. You want your code to be the thing that stops a compromised credential or a runaway AI coding agent before it impacts production.

What You’ll Do

• Design, build, and own our Endpoint Security client: process execution, file, and signal events, plus the synchronous authorization events where you allow or deny inline. You'll block operations by returning a deny verdict before the event completes, not by logging after the fact, and you'll build the userspace agent that installs and drives the extension.
• Own the enforcement decision path: event capture from Endpoint Security, policy evaluation, and deny decisions applied within Apple's authorization deadline so a slow verdict never stalls the system or gets auto-allowed.
• Drive down enforce-mode latency on the authorization path as we scale across large fleets. That means process enrichment, code-signature and hash caching with eviction under heavy process-churn, and process-ancestry resolution.
• Extend enforcement across network and content control: a Network Extension content filter for socket- and flow-level policy, tied to the same identity and process context as your Endpoint Security decisions. Much of this integration is greenfield, and it sits at the center of the role.
• Harden portability and stability across macOS versions and both Apple Silicon and Intel, so enforcement loads and behaves correctly on the OS versions customers actually run. You'll deal with Endpoint Security event and capability drift across releases, System Extension activation and approval flows, TCC and entitlement requirements, and graceful degradation when a capability isn't available.
• Partner with the Linux and Windows enforcement engineers and the policy-backend team on the shared plane: policy semantics, cross-stack conformance, event schema, the common Rust agent. You'll represent macOS in cross-org architecture reviews.
• Read requirements to find gaps and risks, propose simplifications, and explain tradeoffs to technical and non-technical stakeholders.
• Raise the engineering bar. You'll take end-to-end ownership from design through production, and you'll carry extra weight where a bug means a wrong security decision or a hung endpoint across the fleet, not just a crash of one process.
• Mentor senior and mid-level engineers on macOS systems and Endpoint Security craft

What You’ll Bring

• Deep macOS system internals - the Endpoint Security framework, System and Network Extensions, the code-signing and notarization model, launchd and XPC, TCC and entitlements - backed by production systems programming in C, C++, Objective-C, Swift, or Rust.
• Hands-on wor