Senior Software Engineer - Windows Endpoint Security (C#)

About us:
Creative Chaos is an AI orchestration company. We help businesses re-engineer how work actually gets done by placing AI orchestrators inside their teams to redesign workflows, deploy agents, and rewire operations end-to-end.

Job Summary:
The Windows Device Engineer builds the endpoint agent that sits closest to the user. It runs on every Windows machine, sees the traffic, makes decisions locally, and never gets in the way.

You will own the Windows agent end to end, from the C# service and the filter-driver layer to the local TLS proxy and the on-device ONNX models that make real-time decisions. Your agent has to run on enterprise machines that already have Zscaler or Netskope installed, without breaking them or being broken by them.

This is a hands-on engineering role. We are not hiring someone who has read about WFP. We are hiring someone who has shipped a network-layer agent to thousands of enterprise endpoints and has the debugging scars to prove it.

Job Description:

• Own the Windows endpoint agent: You design, build, and maintain the agent as a production-grade Windows service in C#/.NET. You own its installation, auto-updates, resilience, and performance footprint on the end user’s machine.
• Build the network interception layer: You work with the Windows Filtering Platform (WFP) and filter drivers to intercept, redirect, and inspect traffic at the right layer. You know when to use a callout driver, when a user-mode redirect is enough, and what each choice costs.
• Run a local TLS proxy: You build and harden the local proxy that terminates and inspects TLS traffic on the device. You handle certificate trust, pinning exceptions, and protocol edge cases without degrading the user’s browsing or application experience.
• Ship on-device AI: You integrate and optimize ONNX models that run locally on the endpoint. That means real-time inference under tight CPU, memory, and latency budgets, with no round trip to the cloud for every decision.
• Coexist with the enterprise security stack: You make sure the agent works alongside Zscaler, Netskope, and other SSE/SASE and EDR agents already on the machine. That covers proxy chaining, WFP filter priorities, certificate stores, and the conflicts nobody documents.
• Own quality in the field: You debug real customer environments using ETW traces, WinDbg, and packet captures. You harden the agent against crashes, network drops, and OS updates, and you report reliability in numbers, not anecdotes.

Requirements

• Seasoned Windows systems engineer: 5+ years of experience building Windows desktop or system-level software in C#/.NET. You are comfortable with Windows services, the Win32 APIs, P/Invoke, and the line between user mode and kernel mode.
• Deep network-layer experience: You have built with the Windows Filtering Platform or filter drivers in production. You understand TCP/IP, DNS, HTTP/2, and TLS 1.2/1.3 well enough to intercept them without breaking them. You have built or maintained a local proxy.
• Shipped alongside Zscaler or Netskope: You have shipped an endpoint product that had to coexist with Zscaler, Netskope, or a similar SSE/SASE agent on enterprise devices. You know what goes wrong when two agents fight over the same traffic, and how to fix it.
• On-device ML experience: You have integrated ONNX Runtime, or a similar inference engine, into a client application and tuned it for performance on real user hardware. Experience with DirectML or quantized models is a strong plus.
• Proof of shipping: You can walk us through an endpoint agent you shipped to production: its architecture, the hardest bug you chased, and what you would do differently. Enterprise deployment experience with MSI/MSIX, Intune or SCCM, and code signing is a plus.
• Clear communicator: You can explain a driver-level trade-off to a product manager and a deployment issue to a client’s IT team in plain English. You have worked with US or Western teams.