Senior Windows Endpoint Developer — Workforce AI Security (NXJ-197)
Newxel · Europe
The Role
The Windows agent runs on hundreds of thousands of enterprise machines, enforcing data-loss policies and providing visibility over employee AI usage. The hard part isn’t standard application logic — it’s building deep systems-level software, privileged services, and network interception mechanisms that execute reliably across highly heterogeneous enterprise environments without breaking host operations. The role owns the Windows agent end-to-end, serving as the platform's technical authority while engineering silent installation and updates, certificate trust and TLS interception, system proxy configuration, and seamless coexistence with third-party security software.
About the Product
The platform provides enterprise-wide visibility and governance over employee interactions with generative AI tools and developer environments. Operating at global enterprise scale, it monitors endpoint AI usage, enforces real-time DLP policies, and inspects network traffic directly on managed devices. The Windows agent must operate reliably across highly varied corporate environments, alongside existing antivirus, EDR, VPN, proxy, and device-management software, without disrupting users or corporate connectivity.
Technology Stack:
The core endpoint architecture is built primarily in C# with Python and PowerShell powering tooling and automation. The Windows platform includes privileged Windows services, registry, COM, WMI, UAC and elevation, WinHTTP and WinInet, certificate stores, system proxy configuration, and browser integrations for Edge and Chrome. Network-level interception and inspection may involve Windows Filtering Platform and related system components. Shared cross-platform logic increasingly relies on Python and Rust.
Deployment and field execution are managed through enterprise tooling such as Intune, Configuration Manager, Group Policy, and Tanium. The engineering toolkit includes Visual Studio, MSI and InstallShield, WiX, signtool, WinDbg, Process Monitor, Process Explorer, Wireshark, Git, and GitHub Actions.
What You’ll Be Doing
Own the Windows agent end-to-end, leading architecture for privileged services, inter-process communication, installation, and unattended auto-update pipelines
Architect certificate trust and TLS interception on Windows, including correct handling of machine and user certificate stores, trust chains, and applications that resist interception
Design resilient state-reconciliation logic for system proxy configuration, including coexistence with VPN clients, cloud proxies, and other software competing for proxy state
Build deep integrations into AI developer tools such as Claude Desktop, Cursor, and VS Code to inspect and govern local AI activity
Ensure reliable coexistence with antivirus, EDR, VPN, proxy, and other endpoint security products, fixing compatibility issues in the product rather than relying on customer-side exclusions
Drive field root-cause engineering, using logs, diagnostics, and evidence from real customer environments to turn recurring deployment and runtime failures into permanent product fixes
Own the Windows installation and update experience, including silent installation, upgrades, rollback scenarios, and enterprise deployment edge cases
Act as the definitive Windows technical owner, establishing engineering standards, conducting code reviews, and contributing to the technical direction of the agent
Help ensure the product follows a fail-open philosophy, with every error path designed to degrade gracefully rather than interrupt customer connectivity or access to corporate resources
Must-have requirements
Windows internals. You've built Windows software that relies on the registry (including SYSTEM vs HKCU), processes and services, and Task Scheduler. You're an expert in how these behave on managed endpoints.
Multithreaded development in C# . You've written concurrent code (threads, async, locking) that runs reliably on customer machines.
Networking and protocols. You've built and debugged network-facing software over HTTP/1.1, HTTP/2, QUIC, WebSockets and CONNECT tunnelling. You can explain why Chrome skips a proxy, or stays on a direct connection after the proxy restarts, and you can fix it. You have experience with TLS inspection or interception components and are an expert in certificate chains, intermediates, AKI, and OS and browser trust stores.
AI applications on Windows and macOS. You use AI coding agents and assistants daily (Claude Code, Cursor, Copilot, Gemini CLI) and are an expert in their skills, MCP servers and plugins. You've worked on how these tools communicate with their backends, including streaming and WebSockets.
Security engineering. You've designed security software with a clear view of fail-open vs fail-closed behaviour. You've found and closed DLP bypasses such as odd encodings and partial scanning, and you write secure code by default.
Client-side development. You've built and shipped background services and agents that run on thousands of managed endpoints.
Field debugging. You've taken customer log bundles and found the root cause. This is a big part of the job.
Nice-to-have
Agent extension points. You've built or integrated MCP servers and clients, and you're an wotking with protocol: stdio vs HTTP transports, tool calls and OAuth 2.1. You've also built agent hooks, skills and plugins.
Rust. You've written Rust. We use it for the MCP security proxy and the hooks client.
Proxy configuration. You've configured PAC/WPAD, chained to an upstream proxy, and deployed through MDM (Kandji, Chrome managed policies).
Installer packaging. You've built installers with MSI/WiX, NSIS or Inno, and macOS .pkg.
Other languages. You've written Python, Swift/ObjC, and TypeScript.
Traffic analysis. You've reverse-engineered web app traffic from HAR files or a proxy
How The Team Works
Fail open, always. Nothing shipped may prevent a customer from browsing the internet or reaching corporate resources. Every error path should degrade gracefully
Fix the product, not the customer. When the agent conflicts with another vendor’s software, the engineering team owns the fix rather than asking the customer to add an exclusion
Read the logs before theorising. Diagnosis starts with evidence from the actual machine, not assumptions
Tests are how the team ships confidently into environments it cannot log into. Reproducibility, diagnostics, and automated testing are essential to the development process
Team & Growth
You would join a small Windows-focused team with significant room to grow.
The current core team has two Windows developers and one macOS developer, with a plan to hire several additional Windows engineers.
The role itself is expected to remain focused on Windows development for at least the next 6–12 months, with the opportunity to have significant ownership as the team grows.