Principal Engineer – CPU Hardware Telemetry & Silicon Security

About Cyble

Cyble is an AI-native cybersecurity company building the next generation of autonomous cyber defense. Our products combine threat intelligence, endpoint security, exposure management, and AI-powered detection and response to protect enterprises and governments globally.

We are investing in a new frontier of endpoint protection: using processor-level hardware telemetry to detect malicious behavior at the silicon level.

As part of our Cyble Titan EDR initiative, we are building capabilities that leverage modern CPU architectures, hardware performance monitoring, and advanced machine learning to identify ransomware, malware, exploitation, and other sophisticated threats with high accuracy and minimal system overhead.

We are looking for an exceptional engineer to help build the foundation of this technology.

The Role

We are seeking a Principal Engineer specializing in CPU Hardware Telemetry and Low-Level Systems Engineering to design, develop, and optimize telemetry collection capabilities across modern Intel and AMD processors.

You will work at the intersection of CPU microarchitecture, operating systems, security engineering, and machine learning.

Your primary responsibility will be to develop production-grade technologies that reliably extract, normalize, and analyze hardware-level execution signals for real-time threat detection.

This is a deeply technical, hands-on engineering role with the opportunity to influence the architecture of an emerging category of hardware-assisted cybersecurity.

Key Responsibilities

1. CPU Hardware Telemetry Engineering

Design and implement high-performance telemetry collection using CPU Performance Monitoring Units (PMUs). Work with hardware performance counters (HPCs), architectural and model-specific events, and low-level processor instrumentation. Develop collection capabilities leveraging: Intel Performance Monitoring Counters (PMCs) Intel Precise Event-Based Sampling (PEBS) Intel Processor Trace (Intel PT) Intel Last Branch Records (LBR) AMD Instruction-Based Sampling (IBS) AMD Performance Monitoring Counters Model-Specific Registers (MSRs) Identify and characterize hardware events relevant to malware execution, ransomware, privilege escalation, exploitation, and other suspicious behaviors. Implement adaptive sampling, counter multiplexing, and efficient collection across CPU generations.

2. Kernel-Level and Systems Engineering

Develop low-level telemetry collectors for Windows and Linux operating systems. Implement kernel-mode components, drivers, and privileged user-space services where appropriate. Work with Linux perf_events, eBPF, Windows kernel interfaces, and native operating-system profiling capabilities. Optimize sampling frequency, latency, CPU utilization, memory consumption, and system stability. Ensure telemetry collection operates safely in production without materially affecting endpoint performance. Design robust handling for processor-specific differences, unsupported events, permissions, and firmware configurations.

3. Hardware-Assisted Threat Detection

Collaborate with security researchers and machine learning engineers to transform raw hardware telemetry into actionable behavioral signals. Investigate how CPU execution patterns, branch behavior, cache activity, instruction retirement, and memory-access characteristics can help distinguish benign activity from malicious execution. Develop reliable feature-extraction pipelines suitable for real-time detection models. Evaluate signal robustness against workload changes, environmental noise, and adversarial evasion. Help establish measurable detection accuracy, false-positive rates, and performance benchmarks.

4. CPU Architecture and Virtualization

Build a deep understanding of AMD and Intel processor microarchitectures and their hardware event models. Evaluate telemetry fidelity across processor generations and operating environments. Investigate dif