Staff Software Development Engineer
- Windows Endpoint Diversity. Inclusion. We take care of our employees so they can take care of our customers. Customers who come from all walks of life just like us. As Staff Software Development Engineer, you'll be the Windows kernel authority for the runtime enforcement layer of our Identity Security Platform. These components decide, in-kernel, whether to permit or deny each action an identity or AI agent attempts on a Windows endpoint. You'll set the technical direction for kernel-mode enforcement on Windows and own it end to end. That means hooks that make the right call in real time, across the fleet, without breaking legitimate workloads. Peer engineers own the macOS and Linux enforcement surfaces. You share one policy language, one event schema, and one userspace agent with them, but Windows kernel-space is yours. You want your code to be the thing that stops a compromised credential or a runaway AI coding agent before it impacts production. Own the kernel/user-mode enforcement boundary: kernel-side event capture, policy evaluation in user mode, and deny decisions pushed back into the driver as hash-keyed caches so subsequent hits block inline. Drive down enforce-mode latency on the operation hot path as we scale across large fleets. Extend enforcement into containers and isolation: Windows containers and Host Compute Service workloads, silo
- and job-object-aware policy, and container identity on kernel events. Harden portability and stability across Windows builds so enforcement loads and behaves correctly on the versions customers actually run. You'll deal with structure-versioning across Windows releases, PatchGuard constraints, Driver Verifier and HVCI compliance, WHQL attestation signing, and graceful degradation when a capability isn't available.



Partner with the Linux and macOS enforcement engineers and the policy-backend team on the shared plane: policy semantics, cross-stack conformance, event schema, the common Rust agent. You'll represent Windows in cross-org architecture reviews. Read requirements to find gaps and risks, propose simplifications, and explain tradeoffs to technical and non-technical stakeholders. You'll take end-to-end ownership from design through production, and you'll carry extra weight where a kernel bug means a wrong security decision or a bugcheck across the fleet, not just a crash of one process. Mentor senior and mid-level engineers on Windows systems and kernel-driver craft. This is a Windows specialist role, so the depth requirements are real: ~ Deep Windows kernel internals
- the I/O manager and IRP flow, the object manager, process and thread structures, memory management, the Windows security model (tokens, SIDs, ACLs)
- backed by production kernel-mode driver development in C, C++, or Rust. ~ You've shipped a file-system minifilter or comparable callback-based driver, and you can reason about IRQL, synchronization, safe user-buffer access, and reentrancy in the kernel. Driver signing and deployment reality: WHQL attestation, EV code signing, the WDK and WDF/KMDF, and the operational cost of shipping kernel code to a large install base. ~ The Windows isolation model
- job objects, silos, Windows containers,



AppContainer
- and how it intersects with kernel-level security tooling. ~ Kernel debugging and performance tooling: WinDbg and KD, live-kernel and crash-dump analysis, ETW, Driver Verifier, and the checked-build workflow. ~8+ years in systems-level software engineering, with real depth in Windows kernel development. ~ Demonstrated AI-first development. AI-driven design exploration, code generation, adversarial plan review, and automated pre-merge quality gates are how work ships here, not a side experiment. That matters most in correctness
- and security-critical kernel code, where you have to know exactly when to stop and verify by hand. ~ Full-lifecycle experience, including product release, in an agile setting. ~ A track record of technical leadership on complex, ambiguous initiatives that span teams. You adapt when the situation and the requirements shift. You hold a high bar and push your teams to ship reliable systems, especially where a kernel bug carries outsized risk. You know systems software best practices, from rigorous testing to sharp peer review to architecture that survives contact with production. You reach for AI tools to move faster and think more clearly, and you keep the judgment to slow down and verify by hand when the code demands it. You weigh speed against risk and decide from data. You'd rather ship a correct block a day late than a wrong one now, and you choose your failure modes
- fail-open or fail-closed
- on purpose instead of by accident. Diversity. Inclusion. We take care of our employees so they can take care of our customers. Customers who come from all walks of life just like us. BeyondTrust is the global identity security leader protecting Paths

📌 Country Match Staff Software Development Engineer (Canada)
🏢 BeyondTrust
📍 Canada