Windows Endpoint Security Developer

OpenKrill; United States; Remote; USD 150,000 - 190,000; Full time

Job summary

Hire Hangar is seeking a Windows Endpoint Security Developer (C/C++ & Driver Development) to build a next‑gen AI‑driven protection platform in a remote US‑time‑zone friendly role. You will design kernel‑ and user‑mode services, develop Windows drivers, and optimize data collection for threat detection.

The role requires deep Windows internals knowledge, WinDbg and Sysinternals proficiency, and practical experience with WFP, minifilters, and ETW.

Qualifications

• Experience with Windows endpoint security products (AV, EDR, DLP, firewall) is required.
• Deep C/C++ expertise and Windows driver development experience.
• Strong knowledge of Windows OS fundamentals and internals.
• Experience with kernel-mode communication (IOCTL, ALPC, shared memory).
• Proficient with WinDbg, crash dump analysis, and Sysinternals tools.
• Familiar with WFP, minifilters, ETW and driver signing concepts.
• Excellent written and spoken English; remote-work experience with US/UK teams is preferred.

Responsibilities

• Design and implement Windows endpoint services, including kernel-mode and user-mode components.
• Develop Windows drivers (WDM, KMDF, UMDF) to monitor system activity.
• Build data collection features for AI behavioral monitoring.
• Implement secure hooks and filters using WFP, minifilters, and ETW.
• Collaborate on threat research and translate into detection logic.
• Debug and troubleshoot across kernel and user modes with WinDbg and Sysinternals.
• Ensure compliance with driver signing, PatchGuard, and Secure Boot.
• Optimize agent performance while maintaining visibility and protection.

Skills

C

C++

Windows driver development

Windows internals

English communication

Tools

Windows Driver Frameworks

WFP

minifilters

ETW

WinDbg

Sysinternals

IOCTL

ALPC

Secure Boot

Job description

Join Hire Hangar and work with fast-growing global companies while building a long-term career.

Job Title: Windows Endpoint Security Developer (C/C++ & Driver Development)Location | RemoteTime Zone | US Time Zones (EST–PST)

Role Overview:

We are seeking a Windows Endpoint Security Developer with strong C, C++, and Windows driver development skills to help build an AI-focused endpoint protection platform. This is a full-time, hands-on engineering role. Your first focus will be building a Windows service that collects system, network, and process data to detect and respond to threats. The ideal candidate knows Windows internals well and enjoys building fast, reliable security software.

Key Responsibilities:

• Design and implement Windows endpoint services, including kernel-mode and user-mode modules
• Develop Windows drivers (WDM, KMDF, UMDF) to monitor file system, process, memory, and network activity
• Build features that drive efficient data collection focused on AI behavioral monitoring
• Implement secure hooks and filters using Windows Filtering Platform (WFP), minifilters, and ETW
• Collaborate with the team on threat research strategies and translate them into detection logic using endpoint telemetry
• Perform advanced debugging and troubleshooting across kernel and user mode using WinDbg, crash dump analysis, and Sysinternals tools
• Ensure compliance with Microsoft driver signing, PatchGuard, Secure Boot, and kernel security restrictions
• Optimize agent performance to minimize system impact while maintaining visibility and protection
• Participate in threat modeling, secure coding reviews, and internal security assessments

Required Qualifications:

• Experience working on Windows endpoint security products such as AV, EDR, DLP, firewall, or intrusion prevention (non-negotiable)
• Deep expertise in C, C++, and Windows driver development
• Strong understanding of Windows OS fundamentals and internals
• Experience with kernel-mode communication mechanisms (IOCTL, ALPC, shared memory)
• Proficiency with WinDbg, crash dump analysis, and Sysinternals tools
• Knowledge of Windows Filtering Platform (WFP), minifilters, and ETW
• Understanding of Microsoft driver signing, PatchGuard, and Secure Boot
• Experience with threat modeling and secure coding practices
• Strong written and spoken English with a clear, professional communication style
• Must have prior remote work experience, be fluent with remote collaboration tools and platforms (such as Slack, Zoom, Google Workspace, Asana, or similar), and have ideally worked with US or UK-based companies. Applications without this experience will not be considered.

Preferred Qualifications:

• Familiarity with cross-platform endpoint security (macOS/Linux)
• Experience building telemetry or behavioral analytics pipelines for threat detection
• Exposure to AI/ML-driven security products or monitoring AI agent activity

Tools & Technology:

• C and C++
• Windows Driver Frameworks (WDM, KMDF, UMDF)
• Windows Filtering Platform (WFP), minifilters, and ETW
• WinDbg and Sysinternals tools
• Slack, Zoom, and other remote collaboration tools

We connect top talent with vetted employers, competitive pay, and real growth opportunities.