# Principal macOS Security Researcher

**Company**: Huntress
**Location**: United States of America
**Work arrangement**: remote
**Experience**: senior
**Job type**: full-time
**Salary**: $215,000.00 to $225,000.00 base plus bonus and equity
**Category**: Security
**Industry**: Technology

**Apply**: https://job-boards.greenhouse.io/huntress/jobs/8014350003?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_c657d16c-6e4

## Description

We are seeking a Principal macOS Security Researcher to lead product research initiatives that develop and evaluate macOS security product strategies and technologies. As a Principal macOS Security Researcher, you will identify and prototype new telemetry from Apple's Endpoint Security API and other macOS subsystems to expand prevention, hardening, and detection capabilities.

Responsibilities:

- Lead product research initiatives that develop and evaluate macOS security product strategies and technologies

- Identify and prototype new telemetry from Apple's Endpoint Security API and other macOS subsystems to expand prevention, hardening, and detection capabilities

- Reproduce and analyze macOS attacks through hands-on execution of attacker techniques, malware detonation, and vulnerability exploitation

- Reverse engineer macOS malware and Apple's own security frameworks to identify coverage gaps and inform product direction

- Prototype and test new tools and methodologies for offensive operations against macOS endpoints

- Build proof-of-concept implementations that demonstrate the feasibility of new capabilities

- Document research findings and collaborate with Detection Engineering on writing and tuning detectors

- Coordinate with Product and Engineering teams to integrate and operationalize solutions developed by Security teams

- Stand up ephemeral research environments and attacker infrastructure using cloud, VM, and container technologies

- Track Apple platform changes across beta and release cycles, and assess their impact on agent capability, telemetry, and detection coverage

- Identify and address gaps in macOS product coverage, including false positive and false negative investigations

- Develop internal and external technical documentation to educate customers and adjacent teams on macOS security risks and opportunities

- Mentor and teach across the team on macOS internals, malware analysis, and research methodology

- Promote Huntress' reputation through public speaking, CFPs, blogs, and media interaction

Requirements:

- Deep expertise in macOS system internals, including the security model, code signing and notarization, TCC, SIP, persistence, and the Mach-O file format

- Hands-on experience with Apple's Endpoint Security API and system extension development

- Authority on macOS security threats, attack techniques, and the current macOS malware landscape

- Familiarity with macOS fleet management

- Experience red teaming and performing attack emulation to bypass EDR on macOS

- Proficiency with Swift

- Experience with the MITRE ATT&CK matrix, Sigma, YARA, and Elasticsearch/Kibana

- Track record of building POCs and carrying research from concept through to a shipped product capability

Benefits:

- 100% remote work environment

- Generous paid time off policy, including vacation, sick time, and paid holidays

- 12 weeks of paid parental leave

- Highly competitive and comprehensive medical, dental, and vision benefits plans

- 401(k) with a 5% contribution regardless of employee contribution

- Life and Disability insurance plans

- Stock options for all full-time employees

- One-time $500 reimbursement for building/upgrading home office

- Annual allowance for education and professional development assistance

- $75 USD/month digital reimbursement

- Access to the BetterUp platform for coaching, personal, and professional growth

## Skills

### Required
- macOS system internals
- Apple's Endpoint Security API
- macOS security threats
- Swift
- MITRE ATT&CK matrix
- Sigma
- YARA
- Elasticsearch/Kibana

### Nice to have
- Go
- Python
- Ruby
- Mach-O binaries
- scripted payloads
- debuggers
- disassembler suite

---

Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/huntress/jobs/8014350003?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)