Principal macOS Security Researcher

We are seeking a Principal macOS Security Researcher to lead product research initiatives that develop and evaluate macOS security product strategies and technologies. As a Principal macOS Security Researcher, you will identify and prototype new telemetry from Apple's Endpoint Security API and other macOS subsystems to expand prevention, hardening, and detection capabilities.

Responsibilities:

• Lead product research initiatives that develop and evaluate macOS security product strategies and technologies
• Identify and prototype new telemetry from Apple's Endpoint Security API and other macOS subsystems to expand prevention, hardening, and detection capabilities
• Reproduce and analyze macOS attacks through hands-on execution of attacker techniques, malware detonation, and vulnerability exploitation
• Reverse engineer macOS malware and Apple's own security frameworks to identify coverage gaps and inform product direction
• Prototype and test new tools and methodologies for offensive operations against macOS endpoints
• Build proof-of-concept implementations that demonstrate the feasibility of new capabilities
• Document research findings and collaborate with Detection Engineering on writing and tuning detectors
• Coordinate with Product and Engineering teams to integrate and operationalize solutions developed by Security teams
• Stand up ephemeral research environments and attacker infrastructure using cloud, VM, and container technologies
• Track Apple platform changes across beta and release cycles, and assess their impact on agent capability, telemetry, and detection coverage
• Identify and address gaps in macOS product coverage, including false positive and false negative investigations
• Develop internal and external technical documentation to educate customers and adjacent teams on macOS security risks and opportunities
• Mentor and teach across the team on macOS internals, malware analysis, and research methodology
• Promote Huntress' reputation through public speaking, CFPs, blogs, and media interaction

Requirements:

• Deep expertise in macOS system internals, including the security model, code signing and notarization, TCC, SIP, persistence, and the Mach-O file format
• Hands-on experience with Apple's Endpoint Security API and system extension development
• Authority on macOS security threats, attack techniques, and the current macOS malware landscape
• Familiarity with macOS fleet management
• Experience red teaming and performing attack emulation to bypass EDR on macOS
• Proficiency with Swift
• Experience with the MITRE ATT&CK matrix, Sigma, YARA, and Elasticsearch/Kibana
• Track record of building POCs and carrying research from concept through to a shipped product capability

Benefits:

• 100% remote work environment
• Generous paid time off policy, including vacation, sick time, and paid holidays
• 12 weeks of paid parental leave
• Highly competitive and comprehensive medical, dental, and vision benefits plans
• 401(k) with a 5% contribution regardless of employee contribution
• Life and Disability insurance plans
• Stock options for all full-time employees
• One-time $500 reimbursement for building/upgrading home office
• Annual allowance for education and professional development assistance
• $75 USD/month digital reimbursement
• Access to the BetterUp platform for coaching, personal, and professional growth