Windows Kernel Driver Architect (WFP & Security)

Matcha; Boston, Northern (MA, KY); Hybrid; USD 160,000 - 210,000; Full time

Job summary

CloudZero is seeking a Windows systems engineer to own the kernel-mode driver and related components for our Windows agent. You will sign, package, and ship a robust endpoint product that runs with minimal impact on users.

You’ll ensure fail-open behavior, manage TLS interception, and collaborate with product to align parity with macOS. Ideal candidates have shipped services or drivers on Windows, strong C/C++, KMDF/WDM experience, and a track record of shipping endpoint software at scale.

Qualifications

• Shipped software that runs as a service, a driver, or an endpoint agent on Windows.
• Experience with KMDF or WDM and Windows Driver Kit.
• Working knowledge of Windows networking internals and WFP.
• Proficiency in C/C++ for driver side and Go or another systems language for user-mode side.
• Experience signing kernel drivers and handling EV certificates and attestation.
• Ability to reason about tradeoffs between kernel-level solutions and user-space.

Responsibilities

• Take the Windows agent from proof-of-concept to a signed, installable product that runs on Windows.
• Own the KMDF/WFP driver and the Go relay, aligned as both evolve.
• Solve production driver signing, EV certificates, Secure Boot, and code integrity.
• Build the installer, updater, and enterprise deployment story (MSI, MSIX).
• Design for fail-open; non-AI traffic must never touch our code, and failures must not break endpoints.
• Manage local CA trust and TLS interception.
• Build the endpoint client in Electron and TypeScript; ensure parity with macOS exposure.
• Mentor teammates through code reviews and design feedback.

Skills

KMDF

WDM

Windows Driver Kit

WinDbg

Kernel-mode

C/C++

Go

Electron

TypeScript

Windows Filtering Platform

Code signing

EV certificates

Authenticode

MSIX/MSI/WiX

Job description

CloudZero is seeking a Windows systems engineer to own the kernel-mode driver and related components for our Windows agent. You will sign, package, and ship a robust endpoint product that runs with minimal impact on users.

You’ll ensure fail-open behavior, manage TLS interception, and collaborate with product to align parity with macOS. Ideal candidates have shipped services or drivers on Windows, strong C/C++, KMDF/WDM experience, and a track record of shipping endpoint software at scale.