About the Role Build the agent that Neo's whole product depends on: a privileged, cross-platform systems program written in Rust. Everything Neo shows a security team starts on the endpoint. A sensor runs on every customer machine, takes inventory of the software and AI tools in use, sends that back over an encrypted channel, and enforces policy locally. It runs as a service on Windows and a daemon on macOS, with the access and the responsibility that come with running as SYSTEM and root. This role owns the hard parts of it. What you'll work on • The sensor itself: software inventory, secure telemetry, and on-device policy enforcement, on both Windows and macOS. • Real OS work. On macOS that means Launch Services, Spotlight, IOKit, the Security framework, and Open Directory. On Windows it means services, ETW, WMI, the registry, and WinSock. • The policy enforcement point: evaluating rules over events (including AI-tool use and browser extensions) against a Rego engine, and talking to the backend that makes the decisions. • Encrypted logging and telemetry, crash handling and symbolication, and the recovery path that keeps the agent running and hard to tamper with. • Signed installers and macOS configuration profiles. Tech you'll work with Rust (2024 edition) on Tokio, targeting both macOS and Windows. Windows APIs through the windows crate (services, ETW, WMI, registry, WinSock). macOS through objc2 (IOKit, Security, Open Directory, Launch Services). SQLite via diesel and rusqlite, OpenTelemetry for tracing, Sentry with native minidumps for crashes, and regorus for Rego policy. The codebase bans unwrap, expect, panic, and unchecked indexing at the lint level. What we're looking for • Several years of systems programming in Rust, C, or C++, working close to the OS. • Hands-on experience with the internals of at least one of Windows or macOS (services or daemons, process and file APIs, security frameworks), and the willingness to learn the other. • Care with correctness and failure handling. This code runs as root and SYSTEM, and it can't crash on a customer's machine. • Comfort with concurrency, IPC, and debugging problems that only show up on real hardware. Nice to have • Endpoint security, EDR, or MDM background. • Code signing, installer packaging, or driver-adjacent work. • Cryptography, crash handling, or telemetry pipelines.