They don't need to install a spyware on your computer.
The only defense of the https against mitm attacks is that visiting the site of example.com, no one should be able to create a valid cert for example.com, only the owners of example.com.
This can happen because all the root CAs (essentially, the "root" certs which certificate the ordinary per-domain certs) are only included into the default list of most browsers, if the company/organization behind the root CA guarantees this.
However, in theory anybody can create a root CA (for example, with some openssl commands), and then create "valid" certs for any domains he wants. The problem is only that the browsers won't accept it as a valid cert, as this "home-created root CA" has no chance to ever be included in their default root CA list.
Here is coming your wonderful employer. He, being your employer, can "ask" your browsers to accept his own cert as a valid root CA. This requires only some clicks in any browsers.
After that, he can make MITM attacks against your traffic on the way, that any time your browsers wants to connect a https:// site, the routers intercept the traffic, generate a per-domain certificate for that site (by their own root CA). Then decrypt your traffic, and forward it to the original site as ordinary https requests. If your employer is doing this, is easily visible if you check the security properties of the site. If you see that the site certificate was created by your employer, or at least by a different root CA what is visible from the external network, then you are MITM-ed.
This is highly against any security standards and means also a major privacy problem (for example, if you are using your online banking, they get infos what they should not have), but sometimes it might be legal on company machines.
They don't need to install any complex software on your PC, they only need to install their own root CA. If there is some software by you, probably it only works on to hold that root CA continuously accepted on your browser or maybe alarm if it is somehow removed. The essential part (the traffic eavesdropping, https re-ecnryption) is working on your firewall/router.
The best way to defend against this: embedding your real https traffic into ordinary requests (for example, make it looking as if you would check a wikipedia mirror, or some technical documentation), and hide the real content with steganography. It requires an external server helping you, and looks like an ordinary content provider. I don't know about that such a tool would exist, but developing one is possible and it isn't even very hard.