Windows Endpoint Security Developer

• Design and implement Windows endpoint services, including kernel-mode and user-mode modules
• Develop Windows drivers (WDM, KMDF, UMDF) to monitor file system, process, memory, and network activity
• Build efficient data collection features for AI behavioral monitoring
• Implement secure hooks and filters using WFP, minifilters, and ETW
• Collaborate on threat research strategies and translate them into detection logic using endpoint telemetry
• Perform advanced debugging and troubleshooting across kernel and user mode using WinDbg, crash dump analysis, and Sysinternals tools
• Ensure compliance with Microsoft driver signing, PatchGuard, Secure Boot, and kernel security restrictions
• Optimize agent performance while maintaining visibility and protection
• Participate in threat modeling, secure coding reviews, and internal security assessments
• Build a Windows service that collects system, network, and process data to detect and respond to threats

• Experience working on Windows endpoint security products such as AV, EDR, DLP, firewall, or intrusion prevention (non-negotiable)
• Deep expertise in C, C++, and Windows driver development
• Strong understanding of Windows OS fundamentals and internals
• Experience with kernel-mode communication mechanisms (IOCTL, ALPC, shared memory)
• Proficiency with WinDbg, crash dump analysis, and Sysinternals tools
• Knowledge of Windows Filtering Platform (WFP), minifilters, and ETW
• Understanding of Microsoft driver signing, PatchGuard, and Secure Boot
• Experience with threat modeling and secure coding practices
• Strong written and spoken English with a clear, professional communication style
• Prior remote work experience and fluency with remote collaboration tools and platforms such as Slack, Zoom, Google Workspace, Asana, or similar
• Ideally worked with US or UK-based companies
• Familiarity with cross-platform endpoint security (macOS/Linux) (preferred)
• Experience building telemetry or behavioral analytics pipelines for threat detection (preferred)
• Exposure to AI/ML-driven security products or monitoring AI agent activity (preferred)
• Ability to work from 9:00 AM to 5:00 PM EST
• Ability to complete a video interview within the requested timeline

• Competitive, transparent compensation
• Remote work arrangement
• Long-term career opportunity
• Growth opportunities
• Video interview process with next steps communicated by email