Senior Windows kernel/internal Engineer (C++/C) (IRC300926)

Job Description

Required Hard Skills (The "Must-Haves")

· Expert C/C++: 3+ years of experience in strictly kernel-mode software development.

· WinDbg Mastery: Ability to perform "post-mortem" debugging without symbols for third-party conflicts, and live kernel debugging using VMWare/Hyper-V/KDNET. You must be comfortable analyzing stack traces, register states, and trap frames.

· Windows Internal Knowledge: Deep understanding of:

• IRQLs (Interrupt Request Levels) and DPC/Dispatcher mechanics.
• Memory Management (Paged vs. Non-Paged pool, MDLs).
• Synchronization primitives (Spinlocks, Mutexes, Pushlocks).

· File System Filters: Proven experience with the Filter Manager Model (FltMgr) and Minifilter drivers (FltRegisterFilter, Pre/Post operation callbacks).

· EDR/Security Driver Experience: Familiarity with:

• ObCallbacks (ObRegisterCallbacks).
• Process/Thread/Image Load Notify routines (PsSetCreateProcessNotifyRoutineEx, etc.).
• Avoiding deadlocks when injecting logic into high-frequency system paths.

Preferred Skills (The "Nice-to-Haves")

· Reverse Engineering: Proficiency with IDA Pro or Ghidra to analyze potential conflicts with third-party drivers (e.g., Antivirus conflicts causing the crash).

· x64 Assembly: Ability to read disassembly to pinpoint the exact instruction causing the fault when source lines are ambiguous.

· WHQL/WHCP: Experience with the Windows Hardware Compatibility Program signing process (in case the fix requires re-certification) and Microsoft Virus Initiative program

Job Responsibilities

Write kernel and Driver software that can reach the internals of the operating system.

· Implement novel collection and protection techniques.

· Write robust driver infrastructure.

· Optimize for extreme performance constraints.

· Research uncharted territories of the Windows kernel, drivers, APIs, and internal mechanisms.

· Crash Dump Analysis: Perform deep-dive analysis of kernel memory dumps (Minidumps and Complete Memory Dumps) to identify the root cause of the crash (e.g., race conditions, stack overflows, invalid memory access, IRQL violations).

· Reproduction & Isolation: Design stress tests and verification procedures to reliably reproduce the BSOD in a controlled environment using tools like Driver Verifier and specific load-testing scripts.

· Code Review & Remediation: Audit the existing C/C++ driver code (specifically Minifilter callbacks and process notification routines) for thread safety, proper lock usage (Spinlocks/ERESOURCE), and memory handling.

· Patch Implementation: Implement robust fixes for the identified issues, ensuring zero regression in driver performance or security efficacy.

· Validation: Verify fixes using Microsoft Driver Verifier and HLK (Hardware Lab Kit) basics to ensure stability under high stress.

Department/Project Description

Our clients is an endpoint security company looking for an expert-level Windows Kernel Driver Specialist to assist engineering team in developing next generation Endpoint Detection and Response (EDR) agent. We are looking for an experienced individual to join a team that is responsible for developing our cutting-edge collection, prevention and protection technologies using both documented and undocumented proprietary kernel mode techniques.
The team develops the core kernel technologies for a wide variety of products, from EDR to next-gen AV, including work that encompasses many aspects of kernel development, from infrastructure through filter drivers to function hooking, to name a few.

Skill Category

C++

Keyskills - Must Have

• C++
• Kernel development
• Windows