Principal Engineer – CPU Hardware Telemetry & Silicon Security

About Cyble

Cyble is an AI-native cybersecurity company building the next generation of autonomous cyber defense. Our products combine threat intelligence, endpoint security, exposure management, and AI-powered detection and response to protect enterprises and governments globally.

We are investing in a new frontier of endpoint protection: using processor-level hardware telemetry to detect malicious behavior at the silicon level.

As part of our Cyble Titan EDR initiative, we are building capabilities that leverage modern CPU architectures, hardware performance monitoring, and advanced machine learning to identify ransomware, malware, exploitation, and other sophisticated threats with high accuracy and minimal system overhead.

We are looking for an exceptional engineer to help build the foundation of this technology.

The Role

We are seeking a Principal Engineer specializing in CPU Hardware Telemetry and Low-Level Systems Engineering to design, develop, and optimize telemetry collection capabilities across modern Intel and AMD processors.

You will work at the intersection of CPU microarchitecture, operating systems, security engineering, and machine learning.

Your primary responsibility will be to develop production-grade technologies that reliably extract, normalize, and analyze hardware-level execution signals for real-time threat detection.

This is a deeply technical, hands-on engineering role with the opportunity to influence the architecture of an emerging category of hardware-assisted cybersecurity.

Key Responsibilities

1. CPU Hardware Telemetry Engineering

• Design and implement high-performance telemetry collection using CPU Performance Monitoring Units (PMUs).
• Work with hardware performance counters (HPCs), architectural and model-specific events, and low-level processor instrumentation.
• Develop collection capabilities leveraging:
• Intel Performance Monitoring Counters (PMCs)
• Intel Precise Event-Based Sampling (PEBS)
• Intel Processor Trace (Intel PT)
• Intel Last Branch Records (LBR)
• AMD Instruction-Based Sampling (IBS)
• AMD Performance Monitoring Counters
• Model-Specific Registers (MSRs)
• Identify and characterize hardware events relevant to malware execution, ransomware, privilege escalation, exploitation, and other suspicious behaviors.
• Implement adaptive sampling, counter multiplexing, and efficient collection across CPU generations.

2. Kernel-Level and Systems Engineering

• Develop low-level telemetry collectors for Windows and Linux operating systems.
• Implement kernel-mode components, drivers, and privileged user-space services where appropriate.
• Work with Linux perf_events, eBPF, Windows kernel interfaces, and native operating-system profiling capabilities.
• Optimize sampling frequency, latency, CPU utilization, memory consumption, and system stability.
• Ensure telemetry collection operates safely in production without materially affecting endpoint performance.
• Design robust handling for processor-specific differences, unsupported events, permissions, and firmware configurations.

3. Hardware-Assisted Threat Detection

• Collaborate with security researchers and machine learning engineers to transform raw hardware telemetry into actionable behavioral signals.
• Investigate how CPU execution patterns, branch behavior, cache activity, instruction retirement, and memory-access characteristics can help distinguish benign activity from malicious execution.
• Develop reliable feature-extraction pipelines suitable for real-time detection models.
• Evaluate signal robustness against workload changes, environmental noise, and adversarial evasion.
• Help establish measurable detection accuracy, false-positive rates, and performance benchmarks.

4. CPU Architecture and Virtualization

• Build a deep understanding of AMD and Intel processor microarchitectures and their hardware event models.
• Evaluate telemetry fidelity across processor generations and operating environments.
• Investigate differences between bare-metal and virtualized environments, including counter availability, sampling behavior, and measurement distortion.
• Develop methods for validating and calibrating hardware telemetry across different hardware configurations.
• Work with engineering and ecosystem partners on hardware compatibility, performance optimization, and deployment readiness.

5. Production Engineering

• Build scalable, fault-tolerant telemetry collection components suitable for deployment across enterprise endpoints.
• Develop benchmarking, validation, profiling, and diagnostic tools.
• Maintain comprehensive testing across different CPUs, operating systems, and workload profiles.
• Collaborate with Cyble Titan engineering teams to integrate hardware telemetry into endpoint detection and response workflows.
• Contribute to technical architecture, design reviews, engineering standards, and intellectual property development.

Required Qualifications

• 8+ years of experience in low-level systems programming, CPU performance engineering, kernel development, processor architecture, or related fields.
• Deep understanding of x86-64 CPU microarchitecture, preferably across Intel and AMD processors.
• Strong practical experience working with CPU PMUs, hardware performance counters, or processor profiling systems.
• Advanced proficiency in C/C++ and experience developing performance-sensitive systems software.
• Strong understanding of operating-system internals, kernel/user-mode boundaries, interrupts, scheduling, memory management, and concurrency.
• Practical experience with hardware telemetry, event-based sampling, tracing, or low-level instrumentation.
• Experience diagnosing hardware counter behavior and performance measurement inaccuracies.
• Ability to interpret processor documentation, performance event specifications, and microarchitectural reference manuals.
• Strong debugging, performance optimization, and engineering problem-solving skills.

We are particularly interested in candidates who have personally built hardware telemetry collection systems, rather than only consumed telemetry through existing profiling tools.

Preferred Qualifications

• Previous engineering experience at Intel, AMD, or a company working extensively with processor performance monitoring.
• Experience developing CPU profiling tools, performance analysis frameworks, or processor observability infrastructure.
• Knowledge of Intel PEBS, Intel PT, LBR, AMD IBS, and vendor-specific performance events.
• Experience with Windows kernel drivers, Linux kernel modules, perf_events, eBPF, or ETW.
• Familiarity with hypervisors, virtual machine execution, and hardware counter virtualization.
• Experience with Rust, assembly language, or low-level instruction-set programming.
• Familiarity with processor power states, CPU topology, SMT, and heterogeneous cores.
• Background in endpoint security, EDR, malware analysis, or behavioral detection.
• Experience integrating real-time telemetry with machine learning systems.
• Contributions to operating-system kernels, profiling tools, processor instrumentation, or related open-source projects.

What Success Looks Like

Within your first 3-9 months, you will have:

• Designed and delivered a reliable CPU hardware telemetry collection architecture.
• Demonstrated collection of relevant processor events across multiple Intel and AMD CPU generations.
• Established benchmarking and validation methodologies for bare-metal and virtualized environments.
• Optimized telemetry collection for low CPU and memory overhead.
• Built integrations that enable hardware-derived signals to support Cyble Titan's threat detection capabilities.
• Helped establish a technical roadmap for scalable, production-ready silicon-assisted endpoint protection.

Why Join Cyble?

This is an opportunity to work on a technically challenging problem at the intersection of processor architecture, operating systems, AI, and cybersecurity.

You will help develop technologies that extend endpoint security beyond traditional software instrumentation, exploring how signals from the processor itself can provide deeper visibility into malicious execution.

You will work with a team of cybersecurity engineers, security researchers, and AI specialists developing technology intended for large-scale enterprise deployment.

If you have spent your career understanding what happens inside a CPU and want to apply that knowledge to building the next generation of cybersecurity, we would love to hear from you.

Visa: Will sponsor.