Staff Software Development Engineer - Windows Endpoint
BeyondTrust3 months ago
Responsibilities
- Design, build, and own Windows kernel-mode enforcement drivers for file-system, process and thread creation, handle, and registry operations.
- Build and maintain the userspace agent that installs and drives enforcement drivers.
- Own kernel-side event capture, user-mode policy evaluation, and hash-keyed deny-decision caches pushed back into drivers.
- Reduce enforce-mode latency through process enrichment, image-hash caching and eviction, and process-ancestry resolution across PPID spoofing.
- Extend enforcement to Windows containers, Host Compute Service workloads, silos, job objects, and container identity on kernel events.
- Ensure enforcement stability across Windows builds, including structure versioning, PatchGuard constraints, Driver Verifier and HVCI compliance, WHQL attestation signing, and graceful capability degradation.
- Collaborate with Linux and macOS enforcement engineers and the policy-backend team on shared policy semantics, event schemas, and the common Rust agent.
- Represent Windows in cross-organization architecture reviews and communicate technical tradeoffs to technical and non-technical stakeholders.
- Provide end-to-end ownership from design through production and mentor senior and mid-level engineers in Windows systems and kernel-driver development.
Requirements
- Deep knowledge of Windows kernel internals, including the I/O manager, IRP flow, object manager, process and thread structures, memory management, and the Windows security model.
- Production kernel-mode driver development in C, C++, or Rust, with hands-on security-enforcement experience shipping a file-system minifilter or comparable callback-based driver.
- Practical knowledge of IRQL, synchronization, safe user-buffer access, kernel reentrancy, and preventing dependency failures from causing crashes.
- Experience with WHQL attestation, EV code signing, the Windows Driver Kit, Windows Driver Framework, and Kernel-Mode Driver Framework.
- Knowledge of job objects, silos, Windows containers, and AppContainer and their interaction with kernel security tooling.
- Experience with WinDbg, KD, live-kernel and crash-dump analysis, ETW, Driver Verifier, and checked-build workflows.
- At least 8 years of systems-level software engineering experience with substantial Windows kernel development depth.
- Experience using Claude Code or a comparable AI development tool as a core part of daily engineering work.
- Working knowledge of systems design patterns and tradeoffs at the kernel/user-mode boundary.
- Full-lifecycle product release experience in an agile environment.
- Track record of technical leadership on complex, ambiguous, cross-team initiatives.
About BeyondTrust
BeyondTrust builds identity and privileged access management software that controls admin rights, manages passwords and keys, and monitors privileged sessions across cloud and on-prem systems. The privately held company, founded in 1985 and headquartered in Johns Creek, Georgia, emerged after Bomgar acquired BeyondTrust and adopted its name. It serves more than 20,000 customers, including 75 of the Fortune 100, via enterprise subscriptions and partner channels.