Tech Lead - Windows EPM

About SailPoint: 

SailPoint is the leader in identity security for the cloud enterprise. Our identity security solutions secure and enable thousands of companies worldwide, giving our customers unmatched visibility into the entirety of their digital workforce, ensuring workers have the right access to do their job – no more, no less. 

Built on a foundation of AI and ML, our Identity Security Cloud Platform, Atlas delivers the right level of access to the right identities and resources at the right time—matching the scale, velocity, and changing needs of today’s cloud-oriented, modern enterprise. 

About the team: 

You’ll be joining the newly formed Privileged Endpoint team, expanding the Windows Endpoint Privilege Management (EPM) product. Your focus will be adding a kernel-mode driver to detect and respond to any Windows process run by a user. You’ll be leading the design, architecture, and implementation of the driver, as well as working on other areas of the EPM product. 

The team is fully remote and predominantly UK-based. As a small team, you will be a key contributor. 

The role:  

In a typical day you’ll be working on designing and implementing low-level kernel driver code in C/C++ that can detect Windows processes being run with elevated privileges, for EPM to perform actions on. You'll extend the existing user-mode component (currently written in Python), to interact with the driver. You’ll also use Golang and UI technologies to develop features for EPM cloud-based microservices. 

You’ll have the opportunity to lead the choice of tools and technologies we use to produce the kernel-mode driver, as well as help improve the design and quality of the user-mode app, and the overall product. 

In 90 days, you’d be on-boarded and landing work as well as architecting a design for the kernel-mode driver. 

In 6 months, you’d be the Subject Matter Expert for the EPM kernel driver and leading its implementation. 

In 1 year, you’d help release the product and lead the technical side of the kernel driver as the team grows. 

Responsibilities: 

• Lead the design and system architecture of a new Windows EPM kernel-mode driver. 

• Deliver efficient, maintainable, and robust features to implement the product design, and guide the development process to other team members. 

• Collaborate with the wider EPM team to integrate Windows EPM with the EPM backend and other SailPoint products. 

• Help implement features on the EPM cloud-based microservices and macOS EPM Client, where needed. 

• Collaborate with peers on designs, code reviews, and testing, and help promote these practices. 

• Help design a testing architecture for the kernel driver, aiming for unit and end-to-end tests to ensure code quality. 

Experience/requirements: 

Required: 

• Collaborative, approachable and articulate 

• Solid understanding of fundamental security concepts, with a strong emphasis on Windows security. This may include: 

• Windows access tokens 

• The EPROCESS structure 

• How to assign privileges to the access token associated with a process 

• Strong experience developing robust kernel-mode drivers on Windows, with detection and handling of running processes a strong plus 

• Knowledge of communication between kernel-mode drivers and user-mode programs, such as IOCTLs 

• History of designing and implementing software products on Windows 

• Expertise in C/C++ 

• BSc in Computer Science or similar or equivalent work experience 

Preferred: 

• Experience in a GUI framework such as WinUI 3/Qt/WPF 

• CI/CD pipelines – Jenkins 

• Experience with Golang 

• Database technologies such as Amazon DynamoDB 

• Containerisation & container orchestration such as Docker 

• Microservices & SaaS 

• 8+ years of experience 

SailPoint is an equal opportunity employer and we welcome everyone to our team. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or veteran status.