Role Summary:

You will own the people, delivery and full lifecycle of a unified endpoint security platform: from roadmap and build, through safe release and operations, to support and end-of-life. The platform protects Windows, macOS, Linux, mobile, servers, virtual desktops, cloud workloads, containers and IoT/OT devices. It spans prevention (EPP), detection and response (EDR/XDR), and posture and compliance management, at a scale of millions of endpoints.

You will build and lead high-performing engineering teams, run the platform as a reliable service, and make sure every agent and content update reaches customers safely.

Key Responsibilities:

A. People leadership and organization

- Lead, coach and grow a multi-team organization, including first-line managers and senior technical staff.
- Run performance management: goals, regular one-on-ones, reviews, promotions, career ladders, and addressing underperformance.
- Design the org structure and team boundaries (agent, cloud backend, console, data pipeline, QA, SRE) and plan headcount and capacity.
- Own hiring end to end: interview loops, hiring bar, sourcing scarce skills (kernel, eBPF, macOS internals), and onboarding.
- Build an inclusive, accountable culture that works across sites and time zones; track engagement and retention.

B. Product lifecycle management

- Own the end-to-end lifecycle of agents, cloud services and console: roadmap, build, release, support, deprecation and end-of-life.
- Run separate release pipelines for agent code and detection content (signatures, rules, models), each with its own validation gates.
- Implement staged rollouts: canary and ring deployments, feature flags, kill switches, automatic rollback, and customer-controlled update channels (N, N-1, N-2).
- Define the agent version support matrix, long-term support (LTS) releases, and deprecation and EOL policies, while keeping APIs and policies backward compatible.
- Deliver day-zero support for new Windows, macOS, Linux kernel and distribution releases through beta OS programs.
- Plan customer migrations between platform versions, editions or acquired products.

C. Architecture and technical oversight

- Partner with principal engineers and architects on the end-to-end platform design: agent/sensor, multi-tenant cloud backend, management console, APIs and data pipeline.
- Run architecture and design reviews; make and document build-vs-buy-vs-partner decisions.
- Keep the agent framework modular (AV, EDR, firewall, device control, DLP, application control) with minimal CPU, memory and I/O footprint.
- Lead the move of kernel-dependent capabilities toward user-mode frameworks as OS vendors restrict kernel access (for example, the Windows endpoint security platform), without losing visibility or tamper resistance.

D. Detection, prevention, response and AI

- Work with threat researchers and detection engineers to deliver behavioral detection, exploit prevention, ransomware protection and rollback, fileless malware defense and memory protection.
- Own MLOps for detection models: deployment, drift monitoring, false-positive management and defense against adversarial ML.
- Deliver GenAI features such as investigation copilots, natural-language threat hunting and agentic SOC workflows, with clear guardrails and evaluation.




- Extend protection to AI tools on the endpoint, such as local AI agents and MCP servers that employees run.
- Build response actions: host isolation, process kill, quarantine, remote shell, live forensics and automated playbooks.
- Map capabilities to MITRE ATT&CK; and validate them through red-team and adversary-emulation testing.

E. Telemetry, data and analytics

- Deliver high-throughput ingestion and stream processing (Kafka or similar) and a security data lake for hunting and analytics.
- Enable XDR by correlating endpoint, identity (ITDR), network, email, browser and cloud signals.
- Manage telemetry cost: tiering, retention, sampling and cost per protected endpoint.
- Build privacy into the pipeline: data minimization, PII pseudonymization, regional data residency and per-tenant retention.

F. Management console, APIs and integrations

- Deliver centralized policy management, role-based access control, fleet visibility and compliance dashboards.
- Provide documented REST/GraphQL APIs and integrations with SIEM, SOAR, ITSM, IAM, MDM and vulnerability management tools.
- Support SaaS, private cloud, on-prem and air-gapped deployments, plus enterprise rollout tooling (Intune, SCCM, Jamf, Ansible) and VDI optimization.

G. Reliability, operations and incident management

- Define SLOs and SLIs for the cloud platform and agent fleet; build observability and fleet health monitoring.
- Own on-call design, incident response, blameless postmortems and follow-up actions.
- Lead major incidents, including communication with customers, executives, Legal and PR.
- Plan capacity, disaster recovery and multi-region failover.
- Build large-scale quality engineering: an OS and device compatibility lab, performance benchmarking, chaos and fault-injection testing, soak testing, and false-positive testing against known-good software before each release.

H. Product security, compliance and regulation

- Embed secure SDLC: threat modeling, SAST/DAST, fuzzing, dependency and supply-chain security, SBOM, reproducible builds and code signing.
- Run a product security incident response team (PSIRT): coordinated vulnerability disclosure, bug bounty, CVEs and security advisories for the product itself.
- Meet regulatory reporting duties, including the EU Cyber Resilience Act (24-hour reporting of actively exploited vulnerabilities from September 2026; full obligations and CE marking from December 2027), NIS2, DORA (for financial-sector customers), CERT-In incident reporting and the India DPDP Act.
- Drive certifications such as ISO 27001, SOC 2, Common Criteria, FedRAMP, FIPS 140-3 and GDPR/data residency, as applicable.
- Plan post-quantum cryptography migration for agent-to-cloud communication and code signing.
- Support independent testing: AV-Test, AV-Comparatives, MITRE ATT&CK; evaluations, and Gartner/Forrester assessments.

I. Business, budget and stakeholder management

- Own the engineering budget: headcount,



cloud spend, tools, licences, vendors and contractors.
- Partner with Product Management on roadmap, packaging, editions and prioritization; contribute to pricing and P&L; discussions.
- Track the competitive landscape and feed it into roadmap decisions.
- Lead technical due diligence and integration for acquisitions.
- Ensure open-source licence compliance, including GPL considerations for Linux kernel modules and eBPF.
- Engage key customers and partners on architecture reviews, escalations and feedback; represent engineering to executives.

Required qualifications

- Education: B.E./B.Tech/M.Tech/MS in Computer Science, Information Security, Electronics or a related field. An MBA or management training is a plus.

Experience:

- 8-10 years in software product development, with at least 6 years in cybersecurity (endpoint security strongly preferred).
- At least 4 years managing engineering teams, including managing other managers or tech leads, and 10+ engineers at once.
- At least 3 years of prior hands-on engineering or architecture work on systems, security or distributed cloud software.
- A proven record of shipping and operating enterprise security products at scale, including at least one full release lifecycle from launch to end-of-life.
- Experience owning production operations: on-call, SLOs and leading major incidents.

Leadership and management skills

- Hiring, coaching, performance management and building manager and tech-lead pipelines.
- Delivery management: planning, estimation, risk management and predictable releases (Agile/Scrum, Protected or similar).
- Budget, vendor and capacity planning.
- Clear written and verbal communication with executives, customers, regulators and engineers, especially during incidents.
- Sound judgment under ambiguity when balancing security efficacy, stability, performance, cost and time-to-market.

Technical skills

- Languages: C/C++ (agent and kernel work), Rust, Go, Python; Java/Kotlin for backend and Android; Swift/Objective-C for macOS/iOS
- OS internals: Windows internals and the move to user-mode security frameworks, Linux kernel/eBPF, macOS security frameworks, mobile OS security models
- Security domains: EPP, EDR, XDR, ITDR, anti-malware, exploit prevention, application and device control, host firewall, DLP, disk encryption, patch and vulnerability management
- Release and lifecycle: Ring/canary deployment, feature flags, rollback, LTS and version support matrices, deprecation and EOL management
- Cloud and backend: AWS/Azure/GCP, microservices, Kubernetes, Kafka, Elasticsearch/OpenSearch, ClickHouse or similar, multi-tenant distributed systems
- Reliability and FinOps: SLOs, observability, incident management, disaster recovery, cloud cost management
- Data and AI: Streaming analytics, MLOps, behavioral and anomaly detection, GenAI/LLM features and guardrails, adversarial ML
- DevSecOps: CI/CD, automated testing at scale, code signing, reproducible builds, SBOM, supply-chain security, PSIRT processes
- Standards and regulation: MITRE ATT&CK;, NIST CSF, CIS Benchmarks, Zero Trust, EU Cyber Resilience Act, NIS2, FIPS 140-3, data-privacy laws
- Protocols and APIs: REST, gRPC, TLS/mTLS, certificate management, OAuth/OIDC, post-quantum cryptography basics

📌 Engineering Manager, Endpoint Security Platform (Gurugram)
🏢 KestrelSec India Private
📍 Gurugram