Role Summary: You will own the people, delivery and full lifecycle of a unified endpoint security platform: from roadmap and build, through protected release and operations, to support and end-of-life. The platform protects Windows, macOS, Linux, mobile, servers, virtual desktops, cloud workloads, containers and IoT/OT devices. It spans prevention (EPP), detection and response (EDR/XDR), and posture and compliance management, at a scale of millions of endpoints. You will build and lead high-performing engineering teams, run the platform as a reliable service, and make sure every agent and content update reaches customers safely.

Key Responsibilities
A. People leadership and organization
• Lead, coach and grow a multi-team organization, including first-line managers and senior technical staff.
• Run performance management: goals, regular one-on-ones, reviews, promotions, career ladders, and addressing underperformance.
• Design the org structure and team boundaries (agent, cloud backend, console, data pipeline, QA, SRE) and plan headcount and capacity.
• Own hiring end to end: interview loops, hiring bar, sourcing scarce skills (kernel, eBPF, macOS internals), and onboarding.
• Build an inclusive, accountable culture that works across sites and time zones; track engagement and retention. B. Product lifecycle management
• Own the end-to-end lifecycle of agents, cloud services and console: roadmap, build, release, support, deprecation and end-of-life.
• Run separate release pipelines for agent code and detection content (signatures, rules, models), each with its own validation gates.
• Implement staged rollouts: canary and ring deployments, feature flags, kill switches, automatic rollback, and customer-controlled update channels (N, N-1, N-2).
• Define the agent version support matrix, long-term support (LTS) releases, and deprecation and EOL policies, while keeping APIs and policies backward compatible.
• Deliver day-zero support for new Windows, macOS, Linux kernel and distribution releases through beta OS programs.
• Plan customer migrations between platform versions, editions or acquired products. C. Architecture and technical oversight
• Partner with principal engineers and architects on the end-to-end platform design: agent/sensor, multi-tenant cloud backend, management console, APIs and data pipeline.
• Run architecture and design reviews; make and document build-vs-buy-vs-partner decisions.
• Keep the agent framework modular (AV, EDR, firewall, device control, DLP, application control) with minimal CPU, memory and I/O footprint.
• Lead the move of kernel-dependent capabilities toward user-mode frameworks as OS vendors restrict kernel access (for example, the Windows endpoint security platform), without losing visibility or tamper resistance. D. Detection, prevention, response and AI
• Work with threat researchers and detection engineers to deliver behavioral detection, exploit prevention, ransomware protection and rollback, fileless malware defense and memory protection.
• Own MLOps for detection models: deployment, drift monitoring, false-positive management and defense against adversarial ML.
• Deliver GenAI features such as investigation copilots, natural-language threat hunting and agentic SOC workflows, with clear guardrails and evaluation.




• Extend protection to AI tools on the endpoint, such as local AI agents and MCP servers that employees run.
• Build response actions: host isolation, process kill, quarantine, remote shell, live forensics and automated playbooks.
• Map capabilities to MITRE ATT&CK; and validate them through red-team and adversary-emulation testing. E. Telemetry, data and analytics
• Deliver high-throughput ingestion and stream processing (Kafka or similar) and a security data lake for hunting and analytics.
• Enable XDR by correlating endpoint, identity (ITDR), network, email, browser and cloud signals.
• Manage telemetry cost: tiering, retention, sampling and cost per protected endpoint.
• Build privacy into the pipeline: data minimization, PII pseudonymization, regional data residency and per-tenant retention. F. Management console, APIs and integrations
• Deliver centralized policy management, role-based access control, fleet visibility and compliance dashboards.
• Provide documented REST/GraphQL APIs and integrations with SIEM, SOAR, ITSM, IAM, MDM and vulnerability management tools.
• Support SaaS, private cloud, on-prem and air-gapped deployments, plus enterprise rollout tooling (Intune, SCCM, Jamf, Ansible) and VDI optimization. G. Reliability, operations and incident management
• Define SLOs and SLIs for the cloud platform and agent fleet; build observability and fleet health monitoring.
• Own on-call design, incident response, blameless postmortems and follow-up actions.
• Lead major incidents, including communication with customers, executives, Legal and PR.
• Plan capacity, disaster recovery and multi-region failover.
• Build large-scale quality engineering: an OS and device compatibility lab, performance benchmarking, chaos and fault-injection testing, soak testing, and false-positive testing against known-good software before each release. H. Product security, compliance and regulation
• Embed secure SDLC: threat modeling, SAST/DAST, fuzzing, dependency and supply-chain security, SBOM, reproducible builds and code signing.
• Run a product security incident response team (PSIRT): coordinated vulnerability disclosure, bug bounty, CVEs and security advisories for the product itself.
• Meet regulatory reporting duties, including the EU Cyber Resilience Act (24-hour reporting of actively exploited vulnerabilities from September 2026; full obligations and CE marking from December 2027), NIS2, DORA (for financial-sector customers), CERT-In incident reporting and the India DPDP Act.
• Drive certifications such as ISO 27001, SOC 2, Common Criteria, FedRAMP, FIPS 140-3 and GDPR/data residency, as applicable.
• Plan post-quantum cryptography migration for agent-to-cloud communication and code signing.
• Support independent testing: AV-Test, AV-Comparatives, MITRE ATT&CK; evaluations, and Gartner/Forrester assessments. I. Business, budget and stakeholder management
• Own the engineering budget: headcount, cloud spend, tools, licences,



vendors and contractors.
• Partner with Product Management on roadmap, packaging, editions and prioritization; contribute to pricing and P&L; discussions.
• Track the competitive landscape and feed it into roadmap decisions.
• Lead technical due diligence and integration for acquisitions.
• Ensure open-source licence compliance, including GPL considerations for Linux kernel modules and eBPF.
• Engage key customers and partners on architecture reviews, escalations and feedback; represent engineering to executives. Required qualifications
•

Education:
B.
E./B.
Tech/M.
Tech/MS in Computer Science, Information Security, Electronics or a related field. An MBA or management training is a plus.

Experience:
• 8-10 years in software product development, with at least 6 years in cybersecurity (endpoint security strongly preferred).
• At least 4 years managing engineering teams, including managing other managers or tech leads, and 10+ engineers at once.
• At least 3 years of prior hands-on engineering or architecture work on systems, security or distributed cloud software.
• A proven record of shipping and operating enterprise security products at scale, including at least one full release lifecycle from launch to end-of-life.
• Experience owning production operations: on-call, SLOs and leading major incidents. Leadership and management skills
• Hiring, coaching, performance management and building manager and tech-lead pipelines.
• Delivery management: planning, estimation, risk management and predictable releases (Agile/Scrum, SAFe or similar).
• Budget, vendor and capacity planning.
• Clear written and verbal communication with executives, customers, regulators and engineers, especially during incidents.
• Sound judgment under ambiguity when balancing security efficacy, stability, performance, cost and time-to-market. Technical skills
• Languages: C/C++ (agent and kernel work), Rust, Go, Python; Java/Kotlin for backend and Android; Swift/Objective-C for macOS/iOS
• OS internals: Windows internals and the move to user-mode security frameworks, Linux kernel/eBPF, macOS security frameworks, mobile OS security models
• Security domains: EPP, EDR, XDR, ITDR, anti-malware, exploit prevention, application and device control, host firewall, DLP, disk encryption, patch and vulnerability management
• Release and lifecycle: Ring/canary deployment, feature flags, rollback, LTS and version support matrices, deprecation and EOL management
• Cloud and backend: AWS/Azure/GCP, microservices, Kubernetes, Kafka, Elasticsearch/OpenSearch, ClickHouse or similar, multi-tenant distributed systems
• Reliability and FinOps: SLOs, observability, incident management, disaster recovery, cloud cost management
• Data and AI: Streaming analytics, MLOps, behavioral and anomaly detection, GenAI/LLM features and guardrails, adversarial ML
• DevSecOps: CI/CD, automated testing at scale, code signing, reproducible builds, SBOM, supply-chain security, PSIRT processes
• Standards and regulation: MITRE ATT&CK;, NIST CSF, CIS Benchmarks, Zero Trust, EU Cyber Resilience Act, NIS2, FIPS 140-3, data-privacy laws
• Protocols and APIs: REST, gRPC, TLS/mTLS, certificate management, OAuth/OIDC, post-quantum cryptography basics

📌 Engineering Manager, Endpoint Security Platform (Gurugram)
🏢 KestrelSec India Private
📍 Gurugram