Senior Windows Systems Engineer – Endpoint Deployment & PKI

About us:
Creative Chaos is an AI orchestration company. We help businesses re-engineer how work actually gets done by placing AI orchestrators inside their teams to redesign workflows, deploy agents, and rewire operations end-to-end.

Job Summary:
The Senior Windows Systems Engineer makes sure our Windows software gets onto enterprise machines and stays there: signed, trusted, packaged, and deployable at scale.

You will own the path from a built binary to a running agent on thousands of managed devices. That covers kernel driver signing with Microsoft, Intune packaging and deployment, and the full lifecycle of every certificate the product depends on. When a certificate is about to expire, you knew about it 90 days ago. When an enterprise IT team asks how to deploy us, you hand them a package that just works.

This is a hands-on, detail-obsessed role. We are hiring someone who has been through Microsoft’s driver signing process, has packaged software for Intune in production, and treats certificate management as a discipline, not an afterthought.

Job Description:

• Own kernel driver signing: You run the end-to-end signing process for our Windows kernel drivers, including EV code signing, Microsoft Partner Center attestation, and HLK/WHQL submissions where needed. You keep the pipeline compliant with Microsoft’s driver signing requirements as they change.
• Package for the enterprise: You build and maintain MSI, MSIX, and Win32 (.intunewin) packages for Intune deployment. You define install and uninstall logic, detection rules, dependencies, silent installs, and upgrade paths that IT teams can roll out to thousands of devices without a single support ticket.
• Manage the certificate lifecycle: You own every certificate the product relies on: code signing, driver signing, root and intermediate certificates for TLS inspection, and device and service certificates. You handle issuance, secure storage in HSMs or key vaults, distribution, rotation, renewal, and revocation, with zero surprise expiries.
• Automate signing and release: You integrate signing and packaging into CI/CD so every release is signed, versioned, and reproducible. No manual steps on someone’s laptop and no private keys in places they should not be.
• Enable customer deployments: You write the deployment guides, Intune configuration profiles, and certificate trust policies that customer IT teams follow. You join calls with their endpoint teams to troubleshoot rollouts when needed.
• Own reliability in the field: You track deployment success rates, failed installs, and signing or trust errors across the install base, and you fix root causes, not symptoms.

Requirements

• Seasoned Windows systems engineer: 5+ years of experience in Windows systems engineering, endpoint engineering, or build and release for Windows software. You know the Windows installer stack, services, the registry, and the certificate stores inside out.
• Driver signing experience: You have signed and shipped Windows kernel drivers in production through Microsoft’s attestation or WHQL process. You understand EV certificates, cross-signing history, and what Secure Boot and HVCI require.
• Hands-on Intune packaging: You have packaged and deployed software through Microsoft Intune at enterprise scale, including Win32 apps, MSI/MSIX, detection rules, and configuration profiles. SCCM/MECM experience is a plus.
• PKI and certificate management: You have managed certificate lifecycles in production, using tools such as Azure Key Vault, HSMs, internal CAs, or certificate management platforms. You can explain a chain of trust to a developer and to a customer’s security team.
• Automation mindset: You script with PowerShell and have built signing or packaging steps into CI/CD pipelines such as GitHub Actions or Azure DevOps.
• Clear communicator: You can walk a US enterprise IT team through a deployment in plain English, and you write documentation people actually follow.