Senior Staff Engineer Cortex XDR - Palo Alto Networks

At Palo Alto Networks®, we’re united by a shared mission—to protect our digital way of life. We thrive at the intersection of innovation and impact, solving real-world problems with cutting-edge technology and bold thinking. Here, everyone has a voice, and every idea counts. If you’re ready to do the most meaningful work of your career alongside people who are just as passionate as you are, you’re in the right place.

Who We Are

In order to be the cybersecurity partner of choice, we must trailblaze the path and shape the future of our industry. This is something our employees work at each day and is defined by our values: Disruption, Collaboration, Execution, Integrity, and Inclusion. We weave AI into the fabric of everything we do and use it to augment the impact every individual can have. If you are passionate about solving real-world problems and ideating beside the best and the brightest, we invite you to join us!

Job Summary

As a Senior Low-Level Software Engineer at Cortex, you will be a technical authority and an escalation point locally for the Cortex Cloud Windows endpoint agent. You will own the kernel- and user-mode components that deliver detection, prevention, and visibility across millions of Windows endpoints, and the deep-system engineering required to keep those components stable, performant, secure, and compatible across a highly fragmented OS and third-party ecosystem. This is a high-impact individual-contributor role. You will be responsible to handle critical field issues escalations from Technical Support teams, root cause analysis, interfacing with the support teams and occasionally with customers during live debug sessions. You will be part of a senior team responsible for the architectural integrity, runtime stability, and forensic debuggability of agent code paths that execute alongside the NT kernel and core OS subsystems - spanning multiple production kernel drivers, user-mode service, injection/hooking engine, and EDR module. Because our agent runs at the highest privilege levels on customer production machines, every defect is potentially a system-wide outage, a blue screen across a fleet, or a security exposure, so engineering rigor, defensive design, and disciplined debugging are non-negotiable.

Key Responsibilities

• Serve as the local technical authority for critical field issues, providing a direct link between customer-facing support teams and the core R&D organization.
• Lead technical investigations for the highest-severity customer escalations, facilitating live debugging sessions in production-adjacent environments to expedite resolution.
• Synthesize complex technical findings into concise, compile RCA reports, actionable reports for Global Support, Product Management, and engineering leadership to inform prioritization, customer communication, and roadmap decisions.