Senior Software Engineer

Senior Software Engineer, Endpoint Sensor About Mimecast The work people build is worth protecting, and it's harder to protect than it used to be. AI agents now move at machine speed with human-level access, and a small slip-up can become a very public one. We disrupt cybercriminal activity before that happens. We think fast, go big, and always demand more of ourselves. We work hard, deliver, and repeat.

We grow with real determination and put success well within reach. We push each other to be better and expect to be pushed back, in a community built on respect, where everyone is counted. Work Protected. Overview Incydr Product Development is looking for a Senior Software Engineer to join the Endpoint Data Protection team. Reporting to the Senior Manager - Engineering, you’ll help protect organizations from data loss and insider risk across millions of endpoints as we invest in the next generation of that protection: defending data wherever it moves, however it moves.

This is a foundational role working on our endpoint sensor technology that runs continuously and reliably on millions of corporate machines across Windows, macOS, and Linux. You'll work at the lowest levels of the operating system, building kernel drivers and Endpoint Security extensions that power how Incydr detects and stops data loss and insider risk. You'll own features end to end, from early research and proof of concept through production at scale.

Mimecast is an AI-First engineering organization. Our teams actively leverage AI-powered development tools across all facets of engineering, and we're looking for someone genuinely curious about working this way—including bringing that curiosity to securing the AI-driven workflows this role increasingly has to defend against. What You'll Do: Design and develop core capabilities for our Windows, macOS, and Linux agents throughout the complete software development and release lifecycle.

Work at the OS boundary, building performant, reliable kernel-mode components and Endpoint Security and Network extensions that handle complex system interactions. Build detection paths and real-time inline enforcement, moving beyond telemetry and alerting to deny/block decisions without compromising endpoint performance. Own features end to end, from early research and proof of concept through production at scale, and integrate agent capabilities with backend and product workflows.

Build always-on components with strong observability, performance, and stability in production. Bring an adversarial, security-first mindset to everything you build, designing components that resist evasion and treat all input as untrusted. Collaborate with product and cloud service teams to turn discoveries into capabilities that support real-world security investigations. What You'll Bring: Deep experience building production software, including substantial work in low-level systems or endpoint development and code that runs continuously and reliably across large-scale endpoint or systems deployments.

Low-level endpoint development expertise on at least one platform: Windows kernel mode, including minifilters, drivers, WFP, and C++; or macOS Endpoint Security and Network Extension frameworks using Swift or C++. Strong C++ fundamentals, with sound judgment about memory, concurrency, and performance trade-offs and fluency with the debugging and profiling tools this work demands.

Experience designing extensible software architectures, including library boundaries and interface contracts, with the discipline to maintain and evolve long-lived code. A security mindset that accounts for both evasion and adversarial behavior and how authorized users move data. This is insider risk, not just external attackers. Experience building real-time inline enforcement and deny/block paths—not just detection and telemetry—under the strict performance and stability constraints of always-on endpoint software.

Performance di