Principal macOS Security Researcher

What We Do:

Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact.

Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC).

As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection.

Huntress now secures more than 5M endpoints and 16M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other.

Reports to:

Manager, Product Research

Location:

Remote US Compensation Range: $ to $ base plus bonus and equity

What You’ll Do:

Lead product research initiatives that develop and evaluate macOS security product strategies and technologies

Identify and prototype new telemetry from Apple's Endpoint Security API and other macOS subsystems to expand prevention, hardening, and detection capabilities

Reproduce and analyze macOS attacks through hands-on execution of attacker techniques, malware detonation, and vulnerability exploitation

Reverse engineer macOS malware and Apple's own security frameworks (XProtect, XProtect Remediator, Gatekeeper, TCC) to identify coverage gaps and inform product direction

Prototype and test new tools and methodologies for offensive operations against macOS endpoints, including EDR evasion and bypass research

Build proof-of-concept implementations that demonstrate the feasibility of new capabilities

Document research findings and collaborate with Detection Engineering on writing and tuning detectors

Coordinate with Product and Engineering teams to integrate and operationalize solutions developed by Security teams

Stand up ephemeral research environments and attacker infrastructure using cloud, VM, and container technologies

Track Apple platform changes across beta and release cycles, and assess their impact on agent capability, telemetry, and detection coverage

Identify and address gaps in macOS product coverage, including false positive and false negative investigations

Develop internal and external technical documentation to educate customers and adjacent teams on macOS security risks and opportunities

Mentor and teach across the team on macOS internals, malware analysis, and research methodology

Promote Huntress' reputation through public speaking, CFPs, blogs, and media interaction

What You Bring To The Team:

Deep expertise in macOS system internals, including the security model, code signing and notarization, TCC, SIP, persistence, and the Mach-O file format

Hands-on experience with Apple's Endpoint Security API and system extension development

Authority on macOS security threats, attack techniques, and the current macOS malware landscape

Familiarity with macOS fleet management (MDM, configuration profiles, mobileconfig deployment)
Experience red teaming and performing attack emulation to bypass EDR on macOSProficiency with Swift. Additional understanding of Go, Python, and/or Ruby is preferred.

Experience with the MITRE ATT CK matrix, Sigma, YARA, and Elasticsearch/Kibana Track record of building POCs and carrying research from concept through to a shipped product capability

Experience…