Principal macOS Security Researcher

🕒 6 days ago

🇺🇸 United States – Remote

💵 $215k - $225k / year

⏰ Full Time

🔴 Lead

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 4%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Huntress

WebsiteLinkedInAll Job Openings

201 - 500 employees

💼 Consulting

🏥 Healthcare

🏭 Manufacturing

Consulting • Healthcare • Manufacturing

Huntress is a cybersecurity firm that provides managed detection, investigation, and response solutions to protect endpoints, identities, and email environments. It offers a platform with managed EDR, security awareness training, ITDR for Microsoft 365, and SIEM solutions, all supported by a 24/7 Security Operations Center. Huntress is designed to secure small and medium-sized businesses against cyber threats. Their services help organizations across industries, ensuring robust protection and compliance, especially in environments like education, finance, healthcare, manufacturing, and government.

📋 Description

• Lead product research initiatives that develop and evaluate macOS security product strategies and technologies • Identify and prototype new telemetry from Apple's Endpoint Security API and other macOS subsystems to expand prevention, hardening, and detection capabilities • Reproduce and analyze macOS attacks through hands-on execution of attacker techniques, malware detonation, and vulnerability exploitation • Reverse engineer macOS malware and Apple's security frameworks (XProtect, XProtect Remediator, Gatekeeper, TCC) to identify coverage gaps and inform product direction • Prototype and test tools and methodologies for offensive operations against macOS endpoints, including EDR evasion and bypass research • Build proof-of-concept implementations demonstrating new capabilities • Document research findings and collaborate with Detection Engineering on writing and tuning detectors • Coordinate with Product and Engineering teams to integrate and operationalize Security team solutions • Stand up ephemeral research environments and attacker infrastructure using cloud, VM, and container technologies • Track Apple platform changes across beta and release cycles and assess impacts on agent capability, telemetry, and detection coverage • Identify and address macOS product coverage gaps, including false positive and false negative investigations • Develop internal and external technical documentation on macOS security risks and opportunities • Mentor and teach the team on macOS internals, malware analysis, and research methodology • Promote Huntress' reputation through public speaking, CFPs, blogs, and media interaction

🎯 Requirements

• Deep expertise in macOS system internals, including the security model, code signing and notarization, TCC, SIP, persistence, and the Mach-O file format • Hands-on experience with Apple's Endpoint Security API and system extension development • Authority on macOS security threats, attack techniques, and the current macOS malware landscape • Familiarity with macOS fleet management (MDM, configuration profiles, mobileconfig deployment) • Experience red teaming and performing attack emulation to bypass EDR on macOS • Proficiency with Swift • Experience with the MITRE ATT&CK matrix, Sigma, YARA, and Elasticsearch/Kibana • Track record of building POCs and carrying research from concept through to a shipped product capability • Experience leading data requirements work and tying it to cost/benefit analysis on collecting and storing only high-value telemetry • Commitment to clear written documentation of research findings • Comfortable reading Apple developer documentation, framework headers, and API references to answer undocumented questions • Additional understanding of Go, Python, and/or Ruby is preferred • An understanding of how SMBs utilize IT automation tools such as PSAs and RMMs is strongly preferred • Bonus: Comfortable reverse engineering Mach-O binaries and scripted payloads using debuggers and a disassembler suite (Binary Ninja, IDA Pro, Hopper, or Ghidra)

🏖️ Benefits

• 100% remote work environment - since our founding in 2015 • Generous paid time off policy, including vacation, sick time, and paid holidays • 12 weeks of paid parental leave • Highly competitive and comprehensive medical, dental, and vision benefits plans • 401(k) with a 5% contribution regardless of employee contribution • Life and Disability insurance plans • Stock options for all full-time employees • One-time $500 reimbursement for building/upgrading home office • Annual allowance for education and professional development assistance • $75 USD/month digital reimbursement • Access to the BetterUp platform for coaching, personal, and professional growth

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume