Principal Windows Systems and Security Architect

About the role

We are seeking a hands‑on principal architect to define the Windows‑first architecture of a specialized endpoint‑security and authorized adversary‑emulation platform for a confidential enterprise client. This senior individual‑contributor role will own the technical blueprint across endpoint components, backend services, communications, identity, observability, release controls and future platform expansion.

Key responsibilities

• Define modular architecture, trust boundaries, privilege model, data flows, component interfaces and deployment lifecycle for a Windows endpoint platform.
• Own threat modeling and security design for enrollment, mutual authentication, certificate and key lifecycle, transport security, authorization, audit logging, update integrity, rollback and recovery.
• Set engineering standards for C/C++ components, Windows service design, backend integration, testing, diagnostics, secure coding and release readiness.
• Review designs and critical implementations involving Windows services, processes, threads, tokens, access control, IPC, networking, storage, installers and signed software delivery.
• Lead design reviews, coach senior engineers, resolve cross‑team technical risks and communicate with product, QA, security research and client stakeholders.

Required profile

• 8+ years of professional systems or security engineering experience with substantial delivery of production Windows software.
• Deep practical knowledge of Windows internals (services, processes, threads, access tokens, ACLs, registry, IPC, networking, eventing, installation and update patterns).
• Strong native C/C++ proficiency to review memory ownership, concurrency, error handling, API usage, performance and security‑sensitive code.
• Demonstrated ownership of architecture for an endpoint agent, systems product, security product or similarly privileged distributed system.
• Working knowledge of applied security architecture: threat modeling, authentication, PKI, TLS, secure key storage, code signing, auditability and supply‑chain controls.

Required skills

• Windows internals (services, processes, threads, tokens, ACLs, registry, IPC, networking, eventing, installation and update mechanisms).
• Native C/C++ development and secure coding practices.
• Security architecture concepts: threat modeling, authentication, PKI, TLS, secure key storage, code signing and supply‑chain controls.
• Experience with Go services, gRPC/Protobuf, relational databases, message queues and containerized/cloud deployments.
• Knowledge of secure development lifecycle tools such as SAST, fuzzing, SBOM generation and signed release pipelines.