RefolkCandidates
Open nowEngineeringEngineering

Windows System Software Engineer

Cylake · Sunnyvale, California

Location
Sunnyvale, California, United States
Employment
Full time
Level
Mid level
Posted
8 weeks ago

About this role

Your Impact

Join a small team building the next generation of cybersecurity products from the ground up. Led by industry veterans with a proven track record of success - you will get to architect, build, and deliver hugely impactful products with this world class team. You will have the opportunity to grow your career and skills along with the company from the very start.

Role Overview

We are looking for an exceptional Windows systems engineer with deep expertise in Windows kernel internals, operating system architecture, and endpoint technologies, who understands Windows below the Win32 API, from the NT kernel and executive subsystems to process lifetime management, memory internals, and modern platform security.

This is not an application development, framework engineering or WinAPI-only developer role.

You'll be designing and building the low-level endpoint infrastructure that powers real-time telemetry, behavioral detection, and system instrumentation across modern Windows environments.

You'll work across kernel-mode and user-mode, developing production-grade systems that operate reliably in highly concurrent, security-sensitive environments.

What you’ll do:

Windows Kernel Engineering

  • Design and develop production-quality Windows kernel drivers using WDM/WDF.

  • Build kernel instrumentation and telemetry pipelines for endpoint visibility.

  • Develop high-performance process, thread, and image lifecycle tracking.

  • Implement scalable kernel callback infrastructure using:

    • Process notifications

    • Thread notifications

    • Image load notifications

    • Object callbacks

    • Registry callbacks

  • Design lock-efficient kernel data structures and synchronization strategies.

  • Build reliable user/kernel communication mechanisms.

  • Debug complex concurrency, synchronization, and memory issues.

  • Windows Systems & Internals

    • Work directly with Windows NT internals beyond documented APIs.

    • Build systems that understand process, thread, memory, and object lifecycles.

    • Analyze scheduler behavior, process creation, and teardown.

    • Work with Windows internals including:

      • Memory management

      • Object Manager

      • Executive subsystems

      • ETW

      • ALPC

      • Handle tables

      • Tokens

      • Registry internals

    • Investigate compatibility across multiple Windows releases.

    • Debug boot-time, runtime, and kernel crash scenarios.

    • Endpoint & Security Engineering

      • Design telemetry systems that power endpoint detection and response.

      • Build behavioral detection capabilities using operating system telemetry.

      • Research modern attack techniques and operating system abuse.

      • Improve visibility into process execution, code loading, and system activity.

      • Design resilient monitoring systems that operate in complex enterprise environments.

      • Evaluate modern Windows security features and how they impact endpoint architecture.

      Reverse Engineering & Debugging

      • Analyze Windows internals and system behavior.

      • Debug kernel crashes, memory corruption, and race conditions.

      • Reverse engineer operating system components when documentation is unavailable.

      • Use debugging and reverse engineering tools to understand low-level execution paths.

      What We're Looking For

      Required Experience

      • Extensive experience building low-level Windows systems software.

      • Deep expertise in Windows kernel architecture and NT internals.

      • Extensive experience developing Windows kernel drivers.

      • Strong knowledge of process, thread, memory, and object management.

      • Expert-level C/C++ programming skills.

      • Experience debugging complex multithreaded systems.

      • Strong understanding of synchronization, paging, interrupts, and x64 architecture.

      • Experience using WinDbg and kernel debugging tools.

      • Ability to reason about undocumented operating system behavior through analysis and debugging.

      Nice to Have

      • Rust experience.

      • Filesystem minifilters.

      • Windows Filtering Platform (WFP) or NDIS.

      • ETW provider development.

      • Hypervisor technologies (VT-x / AMD-V).

      • Secure Kernel, VBS, or HVCI knowledge.

      • Memory forensics or reverse engineering experience.

      • Symbol parsing and Windows build analysis.

      We offer competitive compensation and a comprehensive benefits package designed to support our employees’ health, well-being, and long-term success. The expected salary range for this position is $150,000 - $250,000 per year. Within this range, individual pay is determined based on job-related factors including skills, experience, qualifications, and internal equity. Most candidates can expect an offer within the range listed above. Your recruiter will provide additional details on compensation and benefits to qualified candidates during the hiring process.

      We’re committed to building a diverse, inclusive workplace where everyone can do their best work. We are proud to be an equal opportunity employer and do not discriminate on the basis of race, religion, color, national origin, sex, sexual orientation, age, veteran status, disability, genetic information, or other applicable legally protected characteristic. If you require a reasonable accommodation during the application or interview process, please let us know - we’re happy to support you.

      As published by Cylake. Applications are handled on their site.

      Skills this posting mentions

      EquityKernelApplication Development

      About Cylake

      Cylake is building a complete, AI-native, data-driven cybersecurity platform for the world’s largest and most regulated institutions. Our approach does not depend on the public cloud; instead, it’s designed to operate on-premises or in private cloud environments, so that our customers retain full data and operational control. Our platform is currently under development, in consultation with several design partners, and is planned for general availability in early 2027.

      All 15 openings at Cylake

      One click, then it is written

      Apply to Cylake with a resume written for this role.

      Queue Windows System Software Engineer and I read the posting, rewrite your resume against it, draft the cover letter, and score the fit. Then you press send, or press one button and I fill in Cylake’s form for you.

      1. 01Drop your resume

        A PDF or a LinkedIn URL. About a minute, once.

      2. 02I rank the openings

        Every weekday morning, the live catalog scored against your history. Up to 20 worth your time, not two hundred links.

      3. 03Each one is written up

        Resume rewritten for the posting, a cover letter, a fit score. Press send, or let me fill in the form.

      • 25 sent a week, free
      • No card
      • Nothing sent until you say so

      More roles at Cylake

      See all

      Similar roles elsewhere

      See more

      Put this to work

      Paste your career in once. Every application after that is written for you.

      Drop a resume or a LinkedIn URL. I rank the live openings against it, rewrite the resume and write a cover letter for the best of them, and fill in the employer's form when you press the button. You read, you decide what goes out.

      1. 01Drop your resume

        A PDF or a LinkedIn URL. About a minute, once.

      2. 02I rank the openings

        Every weekday morning, the live catalog scored against your history. Up to 20 worth your time, not two hundred links.

      3. 03Each one is written up

        Resume rewritten for the posting, a cover letter, a fit score. Press send, or let me fill in the form.

      • New matches ranked and written before you are up.
      • Every bullet stays inside what your history supports. Nothing invented.
      • Queued, submitted, interviewing, offer: one screen, not a spreadsheet.

      500 free credits on sign-up. No card. Nothing is sent until you say so.

      Listed from the job board Cylake publishes. Refolk is not the employer and does not handle their hiring. Applications go to Cylake directly.