Lead Software Engineer

Svitla Systems Inc. is looking for a Lead Software Engineer for a full-time position (40 hours per week) in Argentina.

Our client is a small, U.S. software product company with a highly experienced team whose platform automates Windows endpoint management for mid-size and large enterprises. The product turns a plain-English "desired state" policy into fully automated action: an on-endpoint decision engine running on each endpoint scans the machine, prioritizes work by vulnerability severity, and builds its own task sequences to install, configure, patch, and remove software - with no hand-built images, no per-app packaging scripts, and no disruption to end users while it works. The platform also performs bare-metal OS deployment over the internet (including ransomware and mass-outage recovery), completes what Windows Autopilot leaves unfinished, and provisions virtual desktops. Customers run fleets from a few hundred to tens of thousands of endpoints, and the company is moving steadily upmarket.

You will collaborate directly and frequently with the co-founder/CTO and Head of Product to turn product concepts into technical designs, and you will help lead the engineers building alongside you. The domain is unusual enough that even engineers with near-ideal backgrounds have taken several months to become fully productive. The client is looking for someone who wants to go deep on one challenging product and stay.

Requirements:

• 10+ years of professional software engineering experience in systems-level Windows work.
• Very deep Windows internals expertise: boot sequence, services, registry, security tokens and privilege management, and kernel-adjacent (ring 0/ring 1) development.
• Hands-on expertise in Windows OS deployment: WinPE, task sequencing, unattended installation, driver management, and application packaging with install-order dependencies.
• Working knowledge of the endpoint management ecosystem: Microsoft Intune, Configuration Manager (SCCM), Windows Autopilot, and/or comparable platforms such as BigFix or Kaseya, plus an understanding of the limitations and gaps enterprises face with these platforms .
• Expertise in systems programming on Windows (e.g., C/C++ and/or C#/.NET) plus advanced PowerShell.
• Experience with code signing and secure-boot requirements (EV certificates, Microsoft signing and external security review processes), or the demonstrated depth to own them.
• Architect-level design ability: you can take a loosely specified product concept, pressure-test it, and turn it into a sound technical design in direct discussion with the CTO.
• Experience leading or mentoring a small engineering team.
• Fluent English and strong real-time verbal collaboration; this role runs on frequent, direct design conversations, not ticket queues.

Nice to have:

• Prior work building commercial Windows deployment, patching, or endpoint management products.
• Vulnerability management background (CVE/CVSS-driven prioritization and remediation).
• Azure infrastructure and CDN experience.
• Device driver or firmware update development.
• macOS internals and Apple developer ecosystem experience (code signing, notarization and enterprise deployment approvals), which is valuable for the client's future Mac roadmap.

Responsibilities:

• Own the on-endpoint decision engine: endpoint state scanning, desired-state policy interpretation, vulnerability-driven (CVE) prioritization, and self-generated task sequences with dependency ordering and multi-reboot orchestration.
• Zero-disruption update mechanics: detecting in-use applications, deferring and retrying patches, and hooking the Windows startup sequence to complete updates that cannot run while the system in use.
• Bare-metal OS deployment and internet boot: a WinPE-based recovery environment, Microsoft-signed boot code, and fully programmatic (image-free) Windows installation, including recovery when the OS is unbootable or the drive has failed.
• Windows Autopilot completion: taking over Autopilot's single-reboot setup flow to deliver ordered, dependency-aware, fully configured builds, including hands-off staging by device suppliers.
• Pre-boot identity: Microsoft Entra ID (Azure AD) device-code authentication from the recovery environment, where the device has no OS, certificates, or domain trust.
• Content delivery infrastructure: Azure Blob storage and CDN-backed cloud repositories, plus on-premises local repositories and distribution points with network-aware source selection.
• Hardware enablement: driver, firmware, and BIOS/UEFI update automation across supported OEM device families.
• Virtual endpoints: provisioning for VDI, Windows 365 Cloud PCs, and Azure Virtual Desktop.
• Roadmap exploration: future platform expansion, including a potential macOS edition of the product.