About Nightfall:

Nightfall is the AI-native, unified data loss prevention and insider risk management platform that protects sensitive data across SaaS apps, GenAI tools, email, endpoint devices, and more. Hundreds of customers, spanning AI innovators to top 10 banks, trust Nightfall to detect and stop data exfiltration at scale. Nightfall enables organizations to innovate freely without the risks of losing intellectual property or exposing customer data. Our agentic platform helps security teams regain their time by putting data loss prevention on autopilot. With automatic remediation, security violations can be resolved automatically before they become incidents, and end-users can be automatically trained and coached in the moment to self-heal violations that they introduce.

Nightfall is backed by leading VC firms including Bain Capital Ventures (Enrique Salem - former CEO of Symantec), Venrock (early investors in Cloudflare), WestBridge Capital, Pear VC (early investors in Dropbox and Doordash), and a cadre of cybersecurity leaders including Frederic Kerrest (founder of Okta), Maynard Webb (former COO of eBay), Ryan Carlson (President of Chainguard), Kevin Mandia (founder of Mandiant), and many others.

About the role:

This is not a purely organizational role. We are looking for a player-coach - someone who leads the team and writes production code. You will own Nightfall's entire endpoint engineering effort across Mac, Windows, and QA today, while personally driving the architecture and early implementation of our Linux platform from the ground up.

The ideal candidate has spent years in the trenches of systems and kernel-level development and now wants to multiply their impact through leadership - without stepping away from the code. You will set technical direction, mentor senior engineers, drive delivery at startup pace, and remain a hands-on contributor to the most complex and strategic parts of the codebase.

If you are looking for a role where you manage from a distance, this is not it. If you want to ship code that protects data at scale across every major OS - and build the team that does it - read on.

What You Will Own

Hands-on Technical Contribution

• Personally contribute to design, architecture, and implementation - especially on the Mac/Windows platform build-out and the most complex cross-platform challenges.

• Write and review production-quality systems code in C/C++, C#, or Swift/Objective-C; actively participate in code reviews and set the quality bar by example.

• Own architecture decisions on agent design, kernel-userspace interaction, update safety, MDM deployment, and performance/security trade-offs across all three platforms.

• Lead design reviews - not just as a reviewer, but as an author and key decision maker.

• Dive into customer impacting bugs, kernel panics, race conditions, or reliability issues alongside the team when it matters most.

Team Leadership & Growth

• Lead, mentor, and grow a multi-platform team of 10+ endpoint engineers across Mac, Windows - with active hiring underway for Linux.

• Own the full people management lifecycle: hiring bar-setting, onboarding, performance management, career development, and retention.

• Build a high-trust, high-accountability culture where engineers are empowered to own problems end-to-end and move fast without sacrificing reliability.

• Partner with recruiting to close senior Linux engineering talent, using your technical credibility to attract engineers who want to work for someone who gets it.

Execution & Delivery

• Drive quarterly planning and sprint execution across all three platform teams, maintaining alignment on shared milestones and customer commitments.

• Remove blockers relentlessly - technical, organizational, or cross-functional - to keep teams shipping at startup velocity.

• Own end-to-end delivery of the Linux endpoint agent: from initial architecture through GA, coordinating across engineering, QA, security, and CS teams.

• Establish and track engineering health metrics: feature velocity, incident rates, agent reliability SLOs, and customer escalation trends.

Cross-Functional Partnership

• Serve as the primary engineering partner to the VP of Engineering, Product Management, and Security Research on endpoint strategy and roadmap.

• Represent endpoint engineering in customer escalations, security reviews, and enterprise prospect conversations - with the technical depth to be credible in the room.

• Collaborate with QA to raise the bar on test coverage, MDM compatibility validation, and release confidence across Mac, Windows, and Linux.

• Translate field feedback from Customer Success and Solutions Engineering into prioritized, well-scoped engineering outcomes.

Requirements

• 10+ years of software engineering experience, with significant time spent in systems or endpoint engineering - kernel-level, agent development, or OS-native APIs.

• 5+ years in an engineering management or tech lead role, with experience leading teams of 8 or more engineers - but you have never stopped coding.

• Deep, demonstrable expertise in at least one of the three target platforms:

• macOS: Endpoint Security framework, system extensions, IOKit, or macOS VFS.

• Windows: WDF/WDM driver development, filter drivers, or user-mode security agents.

• Linux: eBPF (libbpf, BPF CO-RE), LSM hooks, fanotify/netlink, or kernel module development.

• Comfortable reading and writing production systems code in C/C++; experience with C##, or Swift is a strong plus.

• Proven ability to own complex technical problems end-to-end - not just assign them - while simultaneously managing a team.

• Experience debugging kernel-level issues: kernel panics, race conditions, memory corruption, or IPC failures using tools like lldb, WinDbg, kgdb, ftrace, or perf.

• Track record of hiring and retaining senior engineering talent; engineers want to work for you because you make them better.

• Startup DNA - you define your own structure, move with urgency, and treat ambiguity as an opportunity rather than an obstacle.

• Experience in a security or enterprise software context; familiarity with DLP, EDR, or endpoint security products is a meaningful plus.

Nice to Have

• Prior experience building a Linux endpoint or security agent from zero to production.

• Familiarity with enterprise MDM platforms (Jamf, Kandji, Workspace ONE, Intune) and their constraints on agent deployment and update workflows.

• Experience with cross-platform agent architectures - shared policy models, update frameworks, or IPC layers across Mac, Windows, and Linux.

• Background in XDR/EDR platforms (CrowdStrike, SentinelOne, Microsoft Defender) from an engineering or integration perspective.

• Contributions to open-source systems or security projects (eBPF ecosystem, kernel patches, security tooling).

• Experience leading QA/test engineering teams alongside feature development organizations.

Environment

Nightfall AI takes pride in being an equal-opportunity employer. We value a diverse and global talent pool and the collaboration that results from having a diverse and inclusive team. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran or disability status. Our hiring decisions are based exclusively on merit, qualifications, and business needs.

Compensation

Employee compensation will be determined based on interview performance, level of experience, specialization of skills, and market rate. During the offer discussion, your recruiter will review the finalized base salary, bonus (for applicable roles), benefits & perks, and stock options as they’ll be reflected in the offer letter.