About the role
About
the Role Build the agent that Neo's whole product depends on: a privileged, cross-platform systems program written in Rust. Everything Neo shows a security team starts on the endpoint. A sensor runs on every customer machine, takes inventory of the software and AI tools in use, sends that back over an encrypted channel, and enforces policy locally. It runs as a service on Windows and a daemon on macOS, with the access and the responsibility that come with running as SYSTEM and root. This role owns the hard parts of it.
What you'll work on The sensor itself: software inventory, secure telemetry, and on-device policy enforcement, on both Windows and macOS. Real OS work. On macOS that means Launch Services, Spotlight, IOKit, the Security framework, and Open Directory. On Windows it means services, ETW, WMI, the registry, and WinSock. The policy enforcement point: evaluating rules over events (including AI-tool use and browser extensions) against a policy engine, and talking to the backend that makes the decisions. Encrypted logging and telemetry, crash handling and symbolication, and the recovery path that keeps the agent running and hard to tamper with. Signed installers and macOS configuration profiles. Tech you'll work with The work is low-level systems development in Rust, close to the operating system across Windows, macOS, and Linux - memory, processes, files, and the OS internals that expose them. Alongside that, you'll lean hard on agentic coding tools; deep fluency with at least one is central to
how we work, not a
bonus. Expect to range across the stack - OS internals, AI tooling internals, CI, and a fair amount of reverse engineering - and to learn the parts you don't know yet.
What we're looking for Several years of systems programming in Rust, C, or C++, working close to the OS. Hands-on experience with the internals of at least one of Windows or macOS (services or daemons, process and file APIs, security frameworks), and the willingness to learn the other. Care with correctness and failure handling. This code runs as root and SYSTEM, and it can't crash on a customer's machine. Comfort with concurrency, IPC, and debugging problems that only show up on real hardware.