The Role

You will own the macOS agent end-to-end, building privileged system services, custom IPC architecture, and reliable update mechanisms that maintain machine health at scale. The primary engineering challenge lies in delivering reliable certificate trust, TLS interception, and system proxy configuration on machines you cannot access directly, while gracefully coexisting with competing third-party security stacks.

About the Product

The platform provides visibility and control over how enterprise employees interact with generative AI tools and safeguards data at the endpoint level. Operating across hundreds of thousands of managed Macs, the solution handles network interception and deep integration into AI developer tools without interrupting daily user workflows.

Technology Stack: The core macOS client is written natively in Swift with Objective-C modules across a codebase mid-migration, leveraging lower-level platform interfaces like launchd, XPC, Security.framework, and SystemConfiguration. Tooling and automation rely on Python and Bash, with shared low-level logic expanding into Rust. Deployment and testing run through physical Mac hardware, virtualized macOS pipelines, Xcode, and GitHub Actions across macOS Sonoma, Sequoia, and pre-release operating systems.

What You’ll Be Doing

Architect and maintain privileged system services, inter-process communication, and robust self-updating mechanisms across non-administrated endpoints

Implement TLS interception and certificate trust chains on macOS while resolving edge cases for applications that resist or bypass standard trust mechanisms

Resolve system proxy configuration conflicts dynamically to maintain stability alongside competing endpoint security tools, VPNs, and cloud proxies

Build native interception capabilities for AI developer tools to monitor and apply data-loss policies to generative AI workflows

Enforce fail-open system architecture so local failures never degrade end-user network connectivity or access to corporate assets

Analyze real customer logs and clean-state Mac reproductions to identify root causes and ship permanent fixes for complex deployment issues

Own product fixes when the agent conflicts with other endpoint security products rather than relying on customer-side exclusions or workarounds

Serve as the principal technical authority for macOS engineering decisions across the broader R&D organization

What We Expect

Must-have

5+ years of systems-level software development, including 3+ years delivering production macOS software using Swift and Objective-C

Deep expertise in macOS platform internals, including launchd, XPC, code signing, notarization, packaging, privileged operations, and debugging complex runtime behavior

Solid grounding in networking fundamentals, including system proxies, TLS, certificate trust, and what happens to a connection between an application and the internet

Hands-on proficiency with modern AI development tools such as Claude Code or Cursor, paired with a critical, verification-first approach to AI\-generated code

Clear technical communication skills, with experience resolving critical technical issues alongside field engineers and enterprise IT teams

A CS degree or equivalent practical engineering background

Nice-to-have

Hands-on experience with Security.framework, EndpointSecurity, NetworkExtension content filters or transparent proxies, trust evaluation, or browser extensions for Safari or Chrome

Enterprise deployment experience using MDM solutions such as Jamf Pro, Intune for Mac, or Workspace ONE, including configuration profiles and tools like pkgbuild / productbuild

Experience handling production TLS interception, trust chain management, certificate pinning, or network packet analysis

Proficiency in Rust, Python, Model Context Protocol (MCP), or prior experience building security products such as EDR, CASB, DLP, or browser security solutions

Windows or cross-platform endpoint experience, particularly where consistency across platforms matters

Why This Role Is Worth Your Time

You are building a native macOS platform rather than maintaining a ported Windows client, directly addressing the platform's unique architectural challenges

The role gives you full technical ownership over privileged services, trust chains, proxy configuration, and network components running on endpoints you cannot access directly

You will work in an engineering culture that enforces strict "fail open" reliability and expects teams to fix root-cause product issues rather than rely on customer-side exclusions or temporary workarounds