Senior Windows Endpoint Security Architect (C#)

Creative Chaos; Karachi Division; On-site; PKR 1,800,000 - 3,200,000; Full time

Job summary

Creative Chaos is seeking a seasoned Windows Device Engineer to own and ship a production-grade Windows endpoint agent. You will design the C#/.NET service, implement the network interception via WFP, and run a hardened local TLS proxy with ONNX-based on-device AI.

The role requires close coordination with enterprise SSE/SASE stacks and hands-on debugging in real customer environments. You will lead end-to-end development, ensuring compatibility with Zscaler, Netskope, and similar agents.

Qualifications

• 5+ years of experience building Windows desktop or system-level software in C#/.NET.
• Experience with Windows services, the Win32 APIs, P/Invoke, and the line between user mode and kernel mode.

Responsibilities

• Own the Windows endpoint agent: design, build, and maintain as a production-grade Windows service in C#/.NET; manage installation, auto-updates, resilience and performance.
• Build the network interception layer using Windows Filtering Platform and filter drivers to intercept, redirect, and inspect traffic.
• Run a local TLS proxy: harden a proxy that terminates and inspects TLS traffic without degrading user experience.
• Ship on-device AI: integrate and optimize ONNX models that run locally with tight CPU/memory/latency budgets.
• Coexist with enterprise security stacks (Zscaler, Netskope, SSE/SASE, EDR): manage proxy chaining, WFP priorities, certificate stores, conflicts.
• Own quality in the field: debug in customer environments using ETW traces, WinDbg, and packet captures; report reliability with numbers.

Skills

Windows

C#/.NET

WFP

TLS/SSL

ONNX/ML

End-point security co-existence

Telemetry/Debugging (ETW/WinDbg)

MSIX/Intune/SCCM

Tools

WinDbg

Windows Filtering Platform (WFP)

TLS proxy

ONNX Runtime

Job description

Creative Chaos is seeking a seasoned Windows Device Engineer to own and ship a production-grade Windows endpoint agent. You will design the C#/.NET service, implement the network interception via WFP, and run a hardened local TLS proxy with ONNX-based on-device AI.

The role requires close coordination with enterprise SSE/SASE stacks and hands-on debugging in real customer environments. You will lead end-to-end development, ensuring compatibility with Zscaler, Netskope, and similar agents.