Staff/Principal Software Engineer – Windows Endpoint Agent

About the role

CloudZero is building AI cost intelligence at the endpoint. The Windows Endpoint Agent will extend the existing macOS collector to capture AI workload costs on Windows machines, handling driver, service, signing and deployment while staying invisible to users.

Key responsibilities

• Take the Windows agent from proof‑of‑concept to a signed, installable, auto‑updating product.
• Own the WFP callout driver (KMDF, C/C++) and the user‑mode Go relay, keeping them in sync.
• Implement kernel‑mode driver signing, EV certificates, Microsoft attestation and Secure Boot without weakening code integrity.
• Build installer, update and clean uninstall paths (MSI/MSIX) and define enterprise deployment strategy.
• Design fail‑open behavior so non‑AI traffic never touches the code and driver failures do not break the endpoint.

Required profile

• Deep Windows systems experience with shipped services, drivers or endpoint agents.
• Hands‑on kernel‑mode development using KMDF/WDM, Windows Driver Kit and WinDbg.
• Proficiency in C/C++ for drivers and Go (or another systems language) for user‑mode components.
• Experience with Windows code signing, EV certificates, Authenticode and Microsoft attestation processes.
• Track record of delivering endpoint software to machines you do not control, with a focus on failure‑safe design.

Required skills

• Windows kernel development (KMDF, WDM, WDK, WinDbg)
• Windows Filtering Platform (WFP) traffic interception
• C, C++
• Go (or comparable systems language)
• Electron, TypeScript
• Code signing, EV certificates, Microsoft attestation, Secure Boot
• MSI/MSIX packaging, installer creation
• TLS interception, MITM proxy, certificate trust management