Senior Windows Sensor Performance Engineer

Jobtailor; California (MO); On-site; USD 150,000 - 210,000; Full time

Job summary

Jobtailor is seeking a senior Windows kernel engineer to own the Falcon sensor performance analysis on Windows, develop advanced instrumentation, and drive improvements across ETW/ETL tooling. You will work on complex multi-process interactions and lead observability enhancements for enterprise security products.

The role requires deep expertise in WPA/xperf/ETW tracing, and hands-on experience with kernel APIs related to endpoint security.

Qualifications

• 10+ years of hands-on Windows kernel-mode development or deep Windows systems engineering.
• Expert-level proficiency with WPA, xperf, ETW/WPP tracing, and ETL file analysis, including stack attribution and CPU sampling.
• Strong knowledge of Windows kernel APIs for endpoint security: registry filter manager callbacks, process/thread notifications, load image callbacks, access token APIs.
• Experience navigating complex multi-process interactions and their impact on performance.
• Proven experience using AI to enhance decision-making and workflows.
• Background in enterprise performance benchmarking/analysis (SQL Server under load, VDI/AVD multisession, VPN stack interactions).
• Track record of generating architectural ideas and advocating within mulit-team environments.

Responsibilities

• Own deep-dive performance analysis of the Falcon sensor on Windows from triage to shipped fix, including app compatibility and AV/EDR interaction issues.
• Drive development and improvement of ETW-based diagnostic instrumentation, extending WPP providers, adding new event IDs, versioning existing events.
• Perform WPA/ETL analysis for customer support cases and internal benchmarking, including ETWReader-based bottleneck identification and per-component CPU attribution.
• Review and author PRs targeting Windows sensor performance improvements: load image callbacks, registry filter drivers, and process/thread notification routines.
• Identify sensor observability gaps and push for tooling to close them.

Skills

Windows kernel development

WPA expertise

ETW/WPP tracing

ETL analysis

CPU attribution

Process/thread callbacks

AI in workflows

Performance benchmarking

Multi-process I/O

System architecture ideas

Tools

ETWReader

xperf

ETW

Registry filter driver tooling

Job description

Jobtailor is seeking a senior Windows kernel engineer to own the Falcon sensor performance analysis on Windows, develop advanced instrumentation, and drive improvements across ETW/ETL tooling. You will work on complex multi-process interactions and lead observability enhancements for enterprise security products.

The role requires deep expertise in WPA/xperf/ETW tracing, and hands-on experience with kernel APIs related to endpoint security.