macOS Systems Engineer

About the work

You'll work on the macOS sensor for clients, an on-device security agent.

It monitors file, process, network and identity activity, blocks malicious behavior, and streams telemetry to the cloud.

The sensor runs entirely in user space as a System Extension. Much of the code is shared with Windows and Linux.

The work requires high concurrency, high reliability, careful attention to memory & CPU usage and performance.

Required:

• Languages: modern C++ (C++17/20) and Swift 6 (async/await, actors, strict concurrency checking). Also, Objective-C++ to bridge Swift, C++ and C APIs.
• macOS systems programming: Foundation and Core Foundation, GCD and pthreads, POSIX/BSD APIs, Mach IPC, launched daemons and agents, and XPC (C API and NSXPC Connection).
• Performance, debugging and test: Profiling CPU and memory with Instruments and os_signpost, Debugging with LLDB, crash logs and os_log, XCTest, sanitizers, fuzzing, and Xcode build-based CI, Apple Silicon and Intel.
• Experience with codebases shared across Mac, Windows and Linux.

Core skills:

• Process model and IPC: launched daemons and agents, and XPC (C API and NSXPC Connection).
• Endpoint Security and System Extensions: Endpoint Security clients handling both blocking (AUTH) events and notification events, user/MDM approval, upgrades.
• Network Extension: content filters, both flow-level (NEFilter Data Provider) and packet-level (NEFilterPacketProvider), and Network.framework.
• Security and crypto: Verifying code signatures (SecCode / SecStaticCode) and validating certificates (SecTrust), Keychain, Entitlements, hardened runtime, and macOS privacy permissions.
• Devices and storage: IOKit (hardware and device enumeration) and Disk Arbitration (disk and volume events).
• Packaging and deployment: installers, notarization, and MDM configuration profiles deployed through Jamf, Intune or similar tools.
• Performance, debugging and test: Profiling CPU and memory with Instruments and os_signpost, Debugging with LLDB, crash logs and os_log, XCTest, sanitizers, fuzzing, and Xcode build-based CI.

Nice to have:

• UI: Swift UI and AppKit apps and app extensions.
• Testing against macOS and Xcode betas before public release.
• Experience shipping EDR/AV, network security or device-management products.

Key Skills:: macOS, C++, Swift, Endpoint Security.