CloudZero Staff/Principal Software Engineer to develop and ship a Windows endpoint agent including kernel-mode driver and user-mode service. Responsible for driver signing, packaging, fail-open design, and endpoint client development.
Responsibilities
CloudZero's AI cost intelligence starts at the endpoint. Our macOS collector already captures what coding agents and AI workloads actually cost on the developer's machine: token usage, cost per workflow, latency, and where the value goes. Windows is next, and it is the platform most of our enterprise customers run on.
We are not starting from zero. We have a working proof of concept, a Windows Filtering Platform callout driver that redirects AI provider traffic to a user-mode relay, and that relay shares the same Go capture core as our macOS agent. What we need now is an engineer who can take that from a test-signed lab prototype to something we can sign, ship, and run on customer machines without ever getting in the user's way.
This is real Windows systems work. You will own the kernel-mode driver, the user-mode service, the signing and packaging story, and the fail-open behavior that keeps a customer's network working even when our agent does not. A bug here can blue-screen a machine or break someone's connectivity, so the bar for care is high and the ownership is real. You will set the pattern that every endpoint after Windows follows.
Take the Windows agent from proof of concept to a signed, installable, auto-updating product that runs on Windows.
Own the WFP callout driver (KMDF, C/C++) and the user-mode Go relay that reuses our shared capture core, and keep the two in lockstep as both evolve
Solve production kernel-mode driver signing, EV certificate, Microsoft attestation, Secure Boot, without weakening code integrity on the customer's machine
Build the installer, update, and clean uninstall path (MSI or MSIX), and the enterprise deployment story
Design for fail-open. Non-AI traffic must never touch our code, and a driver or service failure must never break the endpoint
Manage local CA trust and TLS interception, so it is safe, transparent, and fully reversible
Build the endpoint client in Electron and TypeScript, and work directly with product on what the Windows agent exposes to the customer and where it needs to reach parity with macOS
Raise the bar for the engineers around you through code review, design feedback, and direct mentorship
Deep Windows systems experience. You have shipped software that runs as a service, a driver, or an endpoint agent on Windows, not just applications on top of it
Qualification
Comfort debugging with WinDbg
Required
Deep Windows systems experience with shipped software running as a service, driver, or endpoint agent
Kernel-mode or low-level Windows development experience with KMDF or WDM and Windows Driver Kit
Comfort debugging with WinDbg
Working knowledge of Windows networking internals and Windows Filtering Platform or comparable traffic interception
Proficiency in C or C++ for driver side and Go or another systems language for user-mode side
Ability to read and reason about code in unfamiliar languages
Comfort spanning kernel driver to desktop UI or self-awareness of strengths
