Senior Engineer II, Sensor – Sensor Performance Engineering

Jobtailor; California (MO); On-site; USD 150,000 - 210,000; Full time

Job summary

Jobtailor is seeking a senior Windows kernel engineer to own the Falcon sensor performance analysis on Windows, develop advanced instrumentation, and drive improvements across ETW/ETL tooling. You will work on complex multi-process interactions and lead observability enhancements for enterprise security products.

The role requires deep expertise in WPA/xperf/ETW tracing, and hands-on experience with kernel APIs related to endpoint security.

Qualifications

• 10+ years of hands-on Windows kernel-mode development or deep Windows systems engineering.
• Expert-level proficiency with WPA, xperf, ETW/WPP tracing, and ETL file analysis, including stack attribution and CPU sampling.
• Strong knowledge of Windows kernel APIs for endpoint security: registry filter manager callbacks, process/thread notifications, load image callbacks, access token APIs.
• Experience navigating complex multi-process interactions and their impact on performance.
• Proven experience using AI to enhance decision-making and workflows.
• Background in enterprise performance benchmarking/analysis (SQL Server under load, VDI/AVD multisession, VPN stack interactions).
• Track record of generating architectural ideas and advocating within mulit-team environments.

Responsibilities

• Own deep-dive performance analysis of the Falcon sensor on Windows from triage to shipped fix, including app compatibility and AV/EDR interaction issues.
• Drive development and improvement of ETW-based diagnostic instrumentation, extending WPP providers, adding new event IDs, versioning existing events.
• Perform WPA/ETL analysis for customer support cases and internal benchmarking, including ETWReader-based bottleneck identification and per-component CPU attribution.
• Review and author PRs targeting Windows sensor performance improvements: load image callbacks, registry filter drivers, and process/thread notification routines.
• Identify sensor observability gaps and push for tooling to close them.

Skills

Windows kernel development

WPA expertise

ETW/WPP tracing

ETL analysis

CPU attribution

Process/thread callbacks

AI in workflows

Performance benchmarking

Multi-process I/O

System architecture ideas

Tools

ETWReader

xperf

ETW

Registry filter driver tooling

Job description

Responsibilities

• Own deep-dive performance analysis of the Falcon sensor on Windows, from initial triage through root cause to shipped fix — including application compatibility and AV/EDR process interaction issues.
• Drive development and improvement of ETW-based diagnostic instrumentation, extending WPP providers, adding new event IDs, versioning existing events — to give the team visibility into previously opaque code paths.
• Perform WPA/ETL analysis for customer support cases and internal benchmarking, including ETWReader-based bottleneck identification and per-component CPU attribution across sensor subsystems.
• Review and author PRs targeting Windows sensor performance improvements: load image callbacks, registry filter drivers, and process/thread notification routines.
• Identify sensor observability gaps and push for tooling to close them.

Requirements

• 10+ years of hands‑on Windows kernel‑mode development or deep Windows systems engineering
• Expert‑level proficiency with Windows Performance Analyzer (WPA), xperf, ETW/WPP tracing, and ETL file analysis — including stack attribution, CPU sampling, and per‑component time accounting
• Strong working knowledge of Windows kernel APIs relevant to endpoint security: registry filter manager callbacks, process/thread notification callbacks, load image callbacks, access token and impersonation APIs
• Experience navigating complex multi‑process interactions: file I/O storms, SCM/RPC‑driven registry operations, process enumeration overhead, and their cascading effects on application performance
• Proven experience utilizing AI technologies to enhance decision‑making, streamline workflows and processes, improve efficiency and drive business outcomes.
• Background in enterprise performance benchmarking/analysis: SQL Server under load, VDI/AVD multisession, AnyConnect/VPN stack interactions, Cluster Shared Volume I/O
• Track record of generating architectural ideas and advocating for them constructively within mulit‑team environments.