Senior Software Engineer - Windows Endpoint Security (C#)

About us:
Creative Chaos is an AI orchestration company. We help businesses re-engineer how work actually gets done by placing AI orchestrators inside their teams to redesign workflows, deploy agents, and rewire operations end-to-end.

Job Summary:
The Windows Device Engineer builds the endpoint agent that sits closest to the user. It runs on every Windows machine, sees the traffic, makes decisions locally, and never gets in the way.

You will own the Windows agent end to end, from the C# service and the filter-driver layer to the local TLS proxy and the on-device ONNX models that make real-time decisions. Your agent has to run on enterprise machines that already have Zscaler or Netskope installed, without breaking them or being broken by them.

This is a hands-on engineering role. We are not hiring someone who has read about WFP. We are hiring someone who has shipped a network-layer agent to thousands of enterprise endpoints and has the debugging scars to prove it.

Job Description:

• Own the Windows endpoint agent: You design, build, and maintain the agent as a production-grade Windows service in C#/.NET. You own its installation, auto-updates, resilience, and performance footprint on the end user’s machine.
• Build the network interception layer: You work with the Windows Filtering Platform (WFP) and filter drivers to intercept, redirect, and inspect traffic at the right layer. You know when to use a callout driver, when a user-mode redirect is enough, and what each choice costs.
• Run a local TLS proxy: You build and harden the local proxy that terminates and inspects TLS traffic on the device. You handle certificate trust, pinning exceptions, and protocol edge cases without degrading the user’s browsing or application experience.
• Ship on-device AI: You integrate and optimize ONNX models that run locally on the endpoint. That means real-time inference under tight CPU, memory, and latency budgets, with no round trip to the cloud for every decision.
• Coexist with the enterprise security stack: You make sure the agent works alongside Zscaler, Netskope, and other SSE/SASE and EDR agents already on the machine. That covers proxy chaining, WFP filter priorities, certificate stores, and the conflicts nobody documents.
• Own quality in the field: You debug real customer environments using ETW traces, WinDbg, and packet captures. You harden the agent against crashes, network drops, and OS updates, and you report reliability in numbers, not anecdotes.