Senior Windows Systems Engineer - Endpoint Deployment & PKI

About us:
Creative Chaos is an AI orchestration company. We help businesses re-engineer how work actually gets done by placing AI orchestrators inside their teams to redesign workflows, deploy agents, and rewire operations end-to-end.

Job Summary:
The Senior Windows Systems Engineer makes sure our Windows software gets onto enterprise machines and stays there: signed, trusted, packaged, and deployable at scale.

You will own the path from a built binary to a running agent on thousands of managed devices. That covers kernel driver signing with Microsoft, Intune packaging and deployment, and the full lifecycle of every certificate the product depends on. When a certificate is about to expire, you knew about it 90 days ago. When an enterprise IT team asks how to deploy us, you hand them a package that just works.

This is a hands-on, detail-obsessed role. We are hiring someone who has been through Microsoft’s driver signing process, has packaged software for Intune in production, and treats certificate management as a discipline, not an afterthought.

Job Description:

• Own kernel driver signing: You run the end-to-end signing process for our Windows kernel drivers, including EV code signing, Microsoft Partner Center attestation, and HLK/WHQL submissions where needed. You keep the pipeline compliant with Microsoft’s driver signing requirements as they change.
• Package for the enterprise: You build and maintain MSI, MSIX, and Win32 (.intunewin) packages for Intune deployment. You define install and uninstall logic, detection rules, dependencies, silent installs, and upgrade paths that IT teams can roll out to thousands of devices without a single support ticket.
• Manage the certificate lifecycle: You own every certificate the product relies on: code signing, driver signing, root and intermediate certificates for TLS inspection, and device and service certificates. You handle issuance, secure storage in HSMs or key vaults, distribution, rotation, renewal, and revocation, with zero surprise expiries.
• Automate signing and release: You integrate signing and packaging into CI/CD so every release is signed, versioned, and reproducible. No manual steps on someone’s laptop and no private keys in places they should not be.
• Enable customer deployments: You write the deployment guides, Intune configuration profiles, and certificate trust policies that customer IT teams follow. You join calls with their endpoint teams to troubleshoot rollouts when needed.
• Own reliability in the field: You track deployment success rates, failed installs, and signing or trust errors across the install base, and you fix root causes, not symptoms.