Senior Principal Software Engineer – GlobalProtect (Windows & macOS Internals)
Palo Alto Networks8 days ago
Base Salary
$184k - $297k/yr
Responsibilities
- Design and implement low-level GlobalProtect datapath components for Windows and macOS virtual adapters, packet interception, routing, split tunneling, and DNS handling.
- Modernize Windows NDIS and WFP components toward KMDF, WFP, and user-mode patterns, and evolve macOS System Extension and NetworkExtension providers.
- Own Windows HLK qualification, WHQL and attestation signing through Microsoft Partner Center, Apple Developer ID signing, notarization, provisioning, and pipeline automation.
- Triage BSODs, kernel panics, deadlocks, pool corruption, memory leaks, hangs, crash dumps, and performance issues using WinDbg, LLDB, ETW, and unified logging.
- Improve robustness across sleep/wake, Modern Standby, network changes, and interface transitions.
- Implement secure IPC and least-privilege separation among drivers, services, extensions, and user-session processes.
- Lead cross-component architecture and migrations, review designs, collaborate with engineering, QA, and security teams, and mentor systems engineers.
Requirements
- Significant hands-on experience with C and modern C++ on Windows and/or macOS, including deep OS-internals expertise.
- Deep expertise in Windows kernel-mode driver development and debugging or macOS NetworkExtension and SystemExtensions networking agents, with working knowledge of the other platform.
- Experience with NDIS, KMDF/UMDF, virtual network adapters, WFP, callout drivers, routing tables, XPC, Mach messaging, Apple signing, and entitlement models as applicable.
- Experience with Windows HLK testing, WHQL or attestation signing, EV certificates, Microsoft Partner Center, Apple Developer ID notarization, system debuggers, performance tooling, and kernel crash-dump triage.
- Production experience reading and writing Objective-C and Objective-C++; Swift experience is preferred.
- Demonstrated technical leadership through ownership of cross-component architecture or major migrations and mentorship of other engineers.
- Knowledge of VPN and networking mechanics including IPsec/IKEv2, SSL/TLS, DTLS, WireGuard, Path MTU Discovery, IPv4/IPv6 routing, DNS split tunneling, and captive portals is preferred.
- Experience with sleep/wake, Modern Standby, power-state handling, TPM, Secure Enclave, Windows Protected Process Light, Apple Endpoint Security, and interoperability with endpoint security, EDR, and firewall products is preferred.
- Exposure to or interest in Rust for low-level platform networking components is preferred.
- A bachelor’s or master’s degree in Computer Science, Computer Engineering, or a related technical field is preferred.
Benefits
- Most teams work from the office full time, with flexibility when needed.
- The role may include restricted stock units and a bonus in addition to base compensation.
- The employer provides employee benefits and reasonable accommodations for qualified individuals with disabilities or special needs.
About Palo Alto Networks
Palo Alto Networks builds cybersecurity products for enterprises and governments, including next-generation firewalls, cloud security (Prisma Cloud/Prisma Access), and SOC tools (Cortex). It sells subscriptions and appliances with cloud-delivered threat intelligence, securing networks, endpoints, and applications across data centers and public clouds. Founded in 2005 and headquartered in Santa Clara, California, the company is publicly traded on the NYSE under the ticker PANW.