[Hiring] Senior Software Engineer @Creative Chaos

Role Description

The Windows Device Engineer builds the endpoint agent that sits closest to the user. It runs on every Windows machine, sees the traffic, makes decisions locally, and never gets in the way.

• Own the Windows endpoint agent: Design, build, and maintain the agent as a production-grade Windows service in C#/.NET.
• Build the network interception layer: Work with the Windows Filtering Platform (WFP) and filter drivers to intercept, redirect, and inspect traffic.
• Run a local TLS proxy: Build and harden the local proxy that terminates and inspects TLS traffic on the device.
• Ship on-device AI: Integrate and optimize ONNX models that run locally on the endpoint.
• Coexist with the enterprise security stack: Ensure the agent works alongside Zscaler, Netskope, and other SSE/SASE and EDR agents.
• Own quality in the field: Debug real customer environments using ETW traces, WinDbg, and packet captures.

Qualifications

• Seasoned Windows systems engineer: 5+ years of experience building Windows desktop or system-level software in C#/.NET.
• Deep network-layer experience: Built with the Windows Filtering Platform or filter drivers in production.
• Shipped alongside Zscaler or Netskope: Experience with an endpoint product that coexists with Zscaler, Netskope, or similar agents.
• On-device ML experience: Integrated ONNX Runtime or a similar inference engine into a client application.
• Proof of shipping: Experience with endpoint agents shipped to production, including architecture and deployment experience.
• Clear communicator: Ability to explain technical concepts to non-technical stakeholders.

Requirements

• Comfortable with Windows services, the Win32 APIs, P/Invoke, and the line between user mode and kernel mode.
• Understanding of TCP/IP, DNS, HTTP/2, and TLS 1.2/1.3.
• Experience with local proxy maintenance.
• Ability to handle certificate trust, pinning exceptions, and protocol edge cases.
• Experience with enterprise deployment tools like MSI/MSIX, Intune or SCCM, and code signing.