Senior Principal Software Engineer – GlobalProtect (Windows & macOS Internals)

Our Mission

At Palo Alto Networks®, we’re united by a shared mission—to protect our digital way of life. We thrive at the intersection of innovation and impact, solving real-world problems with cutting-edge technology and bold thinking. Here, everyone has a voice, and every idea counts. If you’re ready to do the most meaningful work of your career alongside people who are just as passionate as you are, you’re in the right place.

Who We Are

In order to be the cybersecurity partner of choice, we must trailblaze the path and shape the future of our industry. This is something our employees work at each day and is defined by our values: Disruption, Collaboration, Execution, Integrity, and Inclusion. We weave AI into the fabric of everything we do and use it to augment the impact every individual can have. If you are passionate about solving real-world problems and ideating beside the best and the brightest, we invite you to join us!

We believe collaboration thrives in person. That’s why most of our teams work from the office full time, with flexibility when it’s needed. This model supports real-time problem-solving, stronger relationships, and the kind of precision that drives great outcomes.

Job Summary

About the Role

As a Senior Principal Software Engineer for GlobalProtect, you will be the hands-on technical authority for our endpoint networking stack across the Windows driver and macOS NetworkExtension ecosystems. You will lead the design, reliability, and security of the deepest layers of the client: NDIS virtual adapters and filter drivers, Windows Filtering Platform (WFP) enforcement, macOS System Extensions and NetworkExtension providers, packet processing, routing, DNS handling, and the OS integration points that sit beneath them. This software runs on millions of enterprise devices worldwide.

Your Impact

• Datapath architecture and development. Design and implement low-level components for GlobalProtect's virtual network adapters, packet interception, routing, split-tunneling, and DNS handling on Windows and macOS.
• Platform modernization. Align the client with evolving OS models by moving our Windows NDIS and WFP-based components toward KMDF, WFP, and user-mode patterns where appropriate, and by evolving our macOS System Extension and NetworkExtension providers (NEFilterDataProvider, NEAppProxyProvider, NEDNSProxyProvider, and, where appropriate, NEPacketTunnelProvider).
• Driver qualification and signing. Own Windows Hardware Lab Kit (HLK) test passes, WHQL/attestation signing through the Microsoft Partner Center, and Apple Developer ID signing, notarization, and system extension provisioning. Improve the automation and reliability of these pipelines.
• Critical failure triage. Serve as the escalation engineer for BSODs, kernel panics, deadlocks, pool corruption, memory leaks, and hard-to-reproduce hangs. You will use WinDbg, LLDB, crash dump analysis, ETW, and unified logging.
• Power-state and network-transition robustness. Drive fixes and design improvements for sleep/wake, Modern Standby, network change, and interface transition behavior, which are a recurring source of field issues.
• Secure by design. Implement secure IPC between drivers, system services, extensions, and user-session processes (including XPC and Mach messaging on macOS). Enforce least-privilege separation and deliver memory-safe practices in C and modern C++.
• Technical leadership and mentorship. Partner with engineering, QA, and security teams across the product lifecycle. Mentor systems engineers, review designs, and set the bar for OS-level development and testing.

Qualifications

Minimum Qualifications

• Significant hands-on experience in C and modern C++(C++17/20) on Windows and/or macOS, with deep command of OS internals.
• Deep expertise in at least one of the following, and solid working knowledge of the other:
  • Windows: Kernel-mode driver development and debugging (NDIS miniport and filter drivers, KMDF/UMDF, virtual network adapters), plus practical experience with the Windows Filtering Platform (WFP), callout drivers, and routing tables.
  • macOS: Building and maintaining networking agents with the NetworkExtension and SystemExtensions frameworks, IPC architectures (XPC, Mach messaging), and Apple code-signing and entitlement models.
• Practical experience with driver and extension release pipelines: Windows HLK testing, WHQL/attestation signing (EV certificates, Partner Center), and Apple Developer ID notarization.
• Hands-on experience with system debuggers (WinDbg, LLDB) and performance tooling (Windows Performance Analyzer/ETW, Instruments), including triage of kernel crash dumps.
• Experience reading and writing Objective-C/Objective-C++ in a production codebase is expected. Swift is a plus.
• Demonstrated technical leadership: owning a cross-component architecture or a major migration, and mentoring other engineers.

Preferred Qualifications

• VPN and networking mechanics: Secure tunneling and packet framing (IPsec/IKEv2, SSL/TLS, DTLS, WireGuard), Path MTU Discovery, IPv4/IPv6 dual-stack routing, DNS behavior in split-tunnel configurations, and captive portal handling.
• Power and lifecycle behavior: Experience with sleep/wake, Modern Standby (Windows), and power-state handling in network stacks and system extensions.
• Security integrations: TPM and Secure Enclave posture checks, Windows Protected Process Light (PPL), and Apple's Endpoint Security framework.
• Interoperability: Experience debugging interactions with third-party endpoint security, EDR, and firewall products that also hook into the network stack.
• Modern systems languages: Exposure to or interest in evaluating memory-safe languages such as Rust for low-level platform networking components.
• ​Bachelor’s or Master’s degree in Computer Science, Computer Engineering, or a related technical field. 

Compensation Disclosure

The compensation offered for this position will depend on qualifications, experience, and work location. For candidates who receive an offer at the posted level, the starting base salary (for non-sales roles) or base salary + commission target (for sales/com-missioned roles) is expected to be the annual range listed below. The offered compensation may also include restricted stock units and a bonus. A description of our employee benefits may be found here.

$183,600.00 - $297,000.00/yr

Our Commitment

We’re trailblazers that dream big, take risks, and challenge cybersecurity’s status quo. It’s simple: we can’t accomplish our mission without diverse teams innovating, together.

We are committed to providing reasonable accommodations for all qualified individuals with a disability. If you require assistance or accommodation due to a disability or special need, please contact us at  accommodations@paloaltonetworks.com.

Palo Alto Networks is an equal opportunity employer. We celebrate diversity in our workplace, and all qualified applicants will receive consideration for employment without regard to age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or other legally protected characteristics.

All your information will be kept confidential according to EEO guidelines.

Is role eligible for Immigration Sponsorship?: Yes