CyberArk

CyberArk

Senior Staff Engineer (Cortex XDR)

Santa Clara, United States of America, USA · Staff+

No sponsorshipDetected 25 days ago
C++GitLinuxgRPCAgentic AICustomer SupportLeadershipCommunicationCollaborationProblem Solving

About the role

  • As a Senior Low-Level Software Engineer at Cortex, you will be a technical authority and an escalation point locally for the Cortex Cloud Windows endpoint agent.
  • This is a high-impact individual-contributor role.

Responsibilities

  • Serve as the local technical authority for critical field issues, providing a direct link between customer-facing support teams and the core R&D organization.
  • Lead technical investigations for the highest-severity customer escalations, facilitating live debugging sessions in production-adjacent environments to expedite resolution.
  • Synthesize complex technical findings into concise, compile RCA reports, actionable reports for Global Support, Product Management, and engineering leadership to inform prioritization, customer communication, and roadmap decisions.
  • Design, implement, and maintain user-mode agent components and in some cases Windows kernel drivers.
  • Drive defensive engineering practices so that an agent fault never bricks a customer endpoint - input validation at trust boundaries, graceful degradation, fail-open vs. fail-closed decisions, watchdog/self-healing mechanisms, etc.
  • Partner with the release and content pipelines (GitLab) to gate risky changes and to ensure new agent versions and content/policy updates do not introduce regressions on the diverse hardware and software configurations in the field.
  • Own identification and resolution of kernel-mode and user-mode failures that threaten system stability or agent integrity.
  • Perform deep analysis of complete, kernel, and minidumps using WinDbg to isolate race conditions, memory corruption, use-after-free, deadlocks, lock-order inversions, and pool corruption in production environments.
  • drive the resulting optimizations into shipping code and verify the win with telemetry.
  • Diagnose high-latency operations, CPU contention, and resource exhaustion by analyzing system-wide traces with ETW, Windows Performance Recorder & Analyzer (WPR/WPA), Performance Monitor, Process Monitor, and Process Explorer; drive the resulting optimizations into shipping code and verify the win with telemetry.

Requirements

  • Bachelor's degree with 5 years of experience or Master's degree with 3 years of experience or new grad with PhD.
  • Familiarity with the NT Native API and ALPC/named-pipe/filter-port IPC.
  • ability to root-cause defects from a crash dump alone when live repro is impossible.
  • Experience profiling and optimizing systems software using ETW, WPR/WPA, Performance Monitor, Process Monitor, and Process Explorer to eliminate latency, contention, and resource-exhaustion issues in hot paths.
  • Track record of root-causing complex failures that span kernel, user mode, and third-party software interactions in production environments at scale.
  • Exceptional ability to communicate complex low-level technical concepts to both highly technical peers and non-technical stakeholders, including written incident analyses, post-mortems, and architectural proposals.
  • Systemic Problem Solving - Track record of root-causing complex failures that span kernel, user mode, and third-party software interactions in production environments at scale.
  • If you're ready to do the most meaningful work of your career alongside people who are just as passionate as you are, you're in the right place.
  • Required Qualifications
  • Systems Programming Mastery - Deep, hands-on proficiency in C for both kernel- and user-mode Windows development, plus working command of modern C++ (C++17/20) for library integration. Strong command of undefined behavior, memory models, custom allocators/CRT constraints, and the discipline required for code that cannot crash. Comfort reading/writing x86/x64 assembly (MASM) is strongly desired.
  • Windows Internals - Strong understanding of the NT kernel, I/O manager, object manager, memory manager, IRQL and synchronization primitives, PnP/Power, boot and driver load order, and the Windows security model (tokens, ACLs, integrity levels, Protected Process Light). Familiarity with the NT Native API and ALPC/named-pipe/filter-port IPC.
  • Advanced Debugging - Fluency with WinDbg, including kernel debugging and!analyze workflows, for analyzing complete, kernel, and minidumps
  • Performance Engineering - Experience profiling and optimizing systems software using ETW, WPR/WPA, Performance Monitor, Process Monitor, and Process Explorer to eliminate latency, contention, and resource-exhaustion issues in hot paths.
  • Influence & Communication - Exceptional ability to communicate complex low-level technical concepts to both highly technical peers and non-technical stakeholders, including written incident analyses, post-mortems, and architectural proposals.

Nice to have

  • Security & Detection Libraries - Familiarity with YARA, high-performance regex engines (Hyperscan, RE2), OpenSSL, and serialization/RPC stacks (Protobuf/nanopb, gRPC).
  • Driver Development.
  • Fleet-Scale Telemetry & Reliability.
  • Compensation Disclosure
  • We're trailblazers that dream big, take risks, and challenge cybersecurity's status quo.
  • Palo Alto Networks is an equal opportunity employer.

Compensation

  • The compensation offered for this position will depend on qualifications, experience, and work location.
  • For candidates who receive an offer at the posted level, the starting base salary (for non-sales roles) or base salary + commission target (for sales/com-missioned roles) is expected to be the annual range listed below.
  • The offered compensation may also include restricted stock units and a bonus.
  • We're trailblazers that dream big, take risks, and challenge cybersecurity's status quo.

Benefits

  • A description of our employee benefits may be found here.

Company info

  • In order to be the cybersecurity partner of choice, we must trailblaze the path and shape the future of our industry. This is something our employees work at each day and is defined by our values: Disruption, Collaboration, Execution, Integrity, and Inclusion. We weave AI into the fabric of everything we do and use it to augment the impact every individual can have. If you are passionate about solving real-world problems and ideating beside the best and the brightest, we invite you to join us!
  • This role is remote, but distance is no barrier to impact. Our hybrid teams collaborate across geographies to solve big problems, stay close to our customers, and grow together. You will be part of a culture that values trust, accountability, and shared success where your work truly matters.
  • You will be responsible to handle critical field issues escalations from Technical Support teams, root cause analysis, interfacing with the support teams and occasionally with customers during live debug sessions.
  • At Palo Alto Networks®, we're united by a shared mission-to protect our digital way of life.
  • We thrive at the intersection of innovation and impact, solving real-world problems with cutting-edge technology and bold thinking.
  • Here, everyone has a voice, and every idea counts.
  • In order to be the cybersecurity partner of choice, we must trailblaze the path and shape the future of our industry.
  • This is something our employees work at each day and is defined by our values: Disruption, Collaboration, Execution, Integrity, and Inclusion.
  • We weave AI into the fabric of everything we do and use it to augment the impact every individual can have.
  • If you are passionate about solving real-world problems and ideating beside the best and the brightest, we invite you to join us!
  • This role is remote, but distance is no barrier to impact.
  • Our hybrid teams collaborate across geographies to solve big problems, stay close to our customers, and grow together.
  • You will be part of a culture that values trust, accountability, and shared success where your work truly matters.
  • Work across the native interop boundary - low-level user-mode code injection, API hooking, NT Native API, etc.
  • Identify and remediate functional regressions, performance regressions, and system instability (including bugchecks/BSODs) caused by interactions between the Cortex agent and third-party security software, competing EDR/AV products, virtualization layers, malicious drivers, and low-level system utilities.
  • Use fleet-scale telemetry - crash signatures, BSOD bugcheck codes, content-update regression signals, and driver-conflict indicators - to detect emerging stability issues early, triage and root-cause across kernel, user mode, and third-party boundaries.
  • Own identification and resolution of kernel-mode and user-mode failures that threaten system stability or agent integrity. Perform deep analysis of complete, kernel, and minidumps using WinDbg to isolate race conditions, memory corruption, use-after-free, deadlocks, lock-order inversions, and pool corruption in production environments.
  • Use and help refine internal AI agents via CLI and IDE integrations to accelerate low-level code analysis, automate patch and test generation (GoogleTest-based native unit tests), and speed up the parsing of complex diagnostic telemetry (crash dumps, ETW traces, driver logs, WPP/TMF traces).
  • Systems Programming Mastery

Equal opportunity

  • If you require assistance or accommodation due to a disability or special need, please contact us at accommodations@paloaltonetworks.com.
  • equal opportunity employer.
  • All your information will be kept confidential according to EEO guidelines.

Visa & Work Authorization

  • Is role eligible for Immigration Sponsorship?
  • Please note that we will not sponsor applicants for work visas for this position.
Apply directly at CyberArk →Create a free account for alerts like thisView CyberArk immigration profile

This listing is sourced directly from CyberArk's careers page and normalized into a canonical job model.