Senior Software Engineer - Windows Endpoint Security (C#)

Creative Chaos; Karachi Division; On-site; PKR 1,800,000 - 3,200,000; Full time

Job summary

Creative Chaos is seeking a seasoned Windows Device Engineer to own and ship a production-grade Windows endpoint agent. You will design the C#/.NET service, implement the network interception via WFP, and run a hardened local TLS proxy with ONNX-based on-device AI.

The role requires close coordination with enterprise SSE/SASE stacks and hands-on debugging in real customer environments. You will lead end-to-end development, ensuring compatibility with Zscaler, Netskope, and similar agents.

Qualifications

• 5+ years of experience building Windows desktop or system-level software in C#/.NET.
• Experience with Windows services, the Win32 APIs, P/Invoke, and the line between user mode and kernel mode.

Responsibilities

• Own the Windows endpoint agent: design, build, and maintain as a production-grade Windows service in C#/.NET; manage installation, auto-updates, resilience and performance.
• Build the network interception layer using Windows Filtering Platform and filter drivers to intercept, redirect, and inspect traffic.
• Run a local TLS proxy: harden a proxy that terminates and inspects TLS traffic without degrading user experience.
• Ship on-device AI: integrate and optimize ONNX models that run locally with tight CPU/memory/latency budgets.
• Coexist with enterprise security stacks (Zscaler, Netskope, SSE/SASE, EDR): manage proxy chaining, WFP priorities, certificate stores, conflicts.
• Own quality in the field: debug in customer environments using ETW traces, WinDbg, and packet captures; report reliability with numbers.

Skills

Windows

C#/.NET

WFP

TLS/SSL

ONNX/ML

End-point security co-existence

Telemetry/Debugging (ETW/WinDbg)

MSIX/Intune/SCCM

Tools

WinDbg

Windows Filtering Platform (WFP)

TLS proxy

ONNX Runtime

Job description

About us:
Creative Chaos is an AI orchestration company. We help businesses re-engineer how work actually gets done by placing AI orchestrators inside their teams to redesign workflows, deploy agents, and rewire operations end-to-end.

Job Summary:
The Windows Device Engineer builds the endpoint agent that sits closest to the user. It runs on every Windows machine, sees the traffic, makes decisions locally, and never gets in the way.

You will own the Windows agent end to end, from the C# service and the filter-driver layer to the local TLS proxy and the on-device ONNX models that make real-time decisions. Your agent has to run on enterprise machines that already have Zscaler or Netskope installed, without breaking them or being broken by them.

This is a hands-on engineering role. We are not hiring someone who has read about WFP. We are hiring someone who has shipped a network-layer agent to thousands of enterprise endpoints and has the debugging scars to prove it.

Job Description:

• Own the Windows endpoint agent: You design, build, and maintain the agent as a production-grade Windows service in C#/.NET. You own its installation, auto-updates, resilience, and performance footprint on the end user’s machine.
• Build the network interception layer: You work with the Windows Filtering Platform (WFP) and filter drivers to intercept, redirect, and inspect traffic at the right layer. You know when to use a callout driver, when a user-mode redirect is enough, and what each choice costs.
• Run a local TLS proxy: You build and harden the local proxy that terminates and inspects TLS traffic on the device. You handle certificate trust, pinning exceptions, and protocol edge cases without degrading the user’s browsing or application experience.
• Ship on-device AI: You integrate and optimize ONNX models that run locally on the endpoint. That means real-time inference under tight CPU, memory, and latency budgets, with no round trip to the cloud for every decision.
• Coexist with the enterprise security stack: You make sure the agent works alongside Zscaler, Netskope, and other SSE/SASE and EDR agents already on the machine. That covers proxy chaining, WFP filter priorities, certificate stores, and the conflicts nobody documents.
• Own quality in the field: You debug real customer environments using ETW traces, WinDbg, and packet captures. You harden the agent against crashes, network drops, and OS updates, and you report reliability in numbers, not anecdotes.

• Seasoned Windows systems engineer: 5+ years of experience building Windows desktop or system-level software in C#/.NET. You are comfortable with Windows services, the Win32 APIs, P/Invoke, and the line between user mode and kernel mode.
• Deep network-layer experience: You have built with the Windows Filtering Platform or filter drivers in production. You understand TCP/IP, DNS, HTTP/2, and TLS 1.2/1.3 well enough to intercept them without breaking them. You have built or maintained a local proxy.
• Shipped alongside Zscaler or Netskope: You have shipped an endpoint product that had to coexist with Zscaler, Netskope, or a similar SSE/SASE agent on enterprise devices. You know what goes wrong when two agents fight over the same traffic, and how to fix it.
• On-device ML experience: You have integrated ONNX Runtime, or a similar inference engine, into a client application and tuned it for performance on real user hardware. Experience with DirectML or quantized models is a strong plus.
• Proof of shipping: You can walk us through an endpoint agent you shipped to production: its architecture, the hardest bug you chased, and what you would do differently. Enterprise deployment experience with MSI/MSIX, Intune or SCCM, and code signing is a plus.
• Clear communicator: You can explain a driver-level trade-off to a product manager and a deployment issue to a client's IT team in plain English. You have worked with US or Western teams.