Principal macOS Security Researcher

Jobicy; United States; Remote; USD 215,000 - 225,000; Full time

Benefits offered by this job

Remote work

Paid time off

Parental leave

Medical/Dental/Vision benefits

401(k)

Stock options

Home office reimbursement

Education allowance

Digital reimbursement

Coaching access

Job summary

Huntress seeks a principal macOS security researcher to lead research expanding endpoint protection, telemetry, and detection capabilities. You’ll combine deep macOS internals expertise with malware analysis, attack emulation, and PoC development, partnering with Detection Engineering, Product, and Engineering to ship capabilities.

You’ll mentor the team, publish technical docs, track Apple platform changes, and contribute to public thought leadership while defending SMB endpoints on a

Qualifications

• Deep expertise in macOS internals, security model, and code signing.
• Experience with Endpoint Security API and system extension development.
• Authority on macOS threats, attack techniques, and malware landscape.
• Familiarity with fleet management and SMB IT automation tools is preferred.

Responsibilities

• Lead macOS security research to expand prevention, hardening, telemetry and detection.
• Prototype telemetry from Apple’s Endpoint Security API and subsystems.
• Reproduce and analyze macOS attacks through hands-on execution and detonation.
• Reverse engineer macOS malware and Apple security frameworks to close coverage gaps.
• Mentor teammates and contribute to public thought leadership and detectors.

Skills

macOS security research

macOS system internals

Apple Endpoint Security API

Malware reverse engineering

EDR evasion research

Swift

MITRE ATT&CK

Sigma rules

YARA

Elasticsearch/Kibana

Tools

Binary Ninja

IDA Pro

Hopper

Ghidra

Go

Python

Ruby

Job description

# Principal macOS Security ResearcherReview the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move.Apply for this job View companyRemote from: USASalary: USD 215k–225k / yrDepartment: CybersecurityEmployment: Full TimeExperience: SeniorPublished: 14 Oct 2026Apply before: 13 Nov 2026Listing views: 81Application actions: 4Application toolkit## Make your next move.Prepare your resume, explore your fit, and draft a cover letter for this opportunity.AI Summary## The role, at a glance.Huntress is seeking a principal-level macOS security researcher to lead research that expands endpoint prevention, hardening, telemetry, and detection capabilities. The role combines deep macOS internals expertise with hands-on malware analysis, attack emulation, EDR bypass research, and proof-of-concept development. The researcher will partner with Detection Engineering, Product, and Engineering to operationalize findings into shipped security capabilities. Responsibilities also include mentoring, technical documentation, public-facing thought leadership, and tracking Apple platform changes. This is a US-remote, full-time role focused on defending SMB-oriented endpoint environments.## Role DNAA quick view of the complexity, pace, ownership and collaboration implied by the job description.### Job Complexity5/5EasyHard### Pace & Pressure4/5RelaxedFast-paced### Autonomy Level5/5GuidedFull ownership### Communication Load5/5IndependentCollaborative**AI insight**This is a highly specialized principal role requiring authoritative knowledge of macOS internals, Apple security frameworks, Endpoint Security APIs, reverse engineering, and offensive research. Success requires independently translating novel research into reliable product and detection outcomes while influencing multiple technical teams.## Salary analysisEstimated compensation compared with the broader US market for similar roles.Estimated job median (per year)Market rate**$220,000**US market range (per year)**$200k–$275k**0$302.50k**AI insight**The yearly pay period is inferred from the job context; it was not explicitly stated by the employer. The employer discloses a base compensation range of $215,000 to $225,000 USD; the annual cadence is inferred from the principal-level, US-based full-time context because the posting does not explicitly state a pay period. The midpoint is $220,000 per year, with bonus and equity noted separately. Estimated US annual market pay for a principal macOS security researcher is approximately $200,000 to $275,000, depending on depth of Apple platform research expertise, offensive security experience, and total-rewards structure.## Core skillsSkills and capabilities most closely associated with this opportunity.macOS security researchmacOS system internalsApple Endpoint Security APISystem extension developmentMalware reverse engineeringMach-O analysisEDR evasion researchAttack emulationSwiftMITRE ATT&CKSigma rulesYARAElasticsearchKibanaTechnical documentation**Sample interview questions**Opportunity details## About this role.**What We Do:**Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact.Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers’ protection.Huntress now secures more than 5M endpoints and 16M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other.**Reports to: Manager, Product Research****Location: Remote US****Compensation Range: $215,000.00 to** **$225,000.00 base plus bonus and equity****What You’ll Do:*** Lead product research initiatives that develop and evaluate macOS security product strategies and technologies* Identify and prototype new telemetry from Apple’s Endpoint Security API and other macOS subsystems to expand prevention, hardening, and detection capabilities* Reproduce and analyze macOS attacks through hands-on execution of attacker techniques, malware detonation, and vulnerability exploitation* Reverse engineer macOS malware and Apple’s own security frameworks (XProtect, XProtect Remediator, Gatekeeper, TCC) to identify coverage gaps and inform product direction* Prototype and test new tools and methodologies for offensive operations against macOS endpoints, including EDR evasion and bypass research* Build proof-of-concept implementations that demonstrate the feasibility of new capabilities* Document research findings and collaborate with Detection Engineering on writing and tuning detectors* Coordinate with Product and Engineering teams to integrate and operationalize solutions developed by Security teams* Stand up ephemeral research environments and attacker infrastructure using cloud, VM, and container technologies* Track Apple platform changes across beta and release cycles, and assess their impact on agent capability, telemetry, and detection coverage* Identify and address gaps in macOS product coverage, including false positive and false negative investigations* Develop internal and external technical documentation to educate customers and adjacent teams on macOS security risks and opportunities* Mentor and teach across the team on macOS internals, malware analysis, and research methodology* Promote Huntress’ reputation through public speaking, CFPs, blogs, and media interaction**What You Bring To The Team:*** Deep expertise in macOS system internals, including the security model, code signing and notarization, TCC, SIP, persistence, and the Mach-O file format* Hands-on experience with Apple’s Endpoint Security API and system extension development* Authority on macOS security threats, attack techniques, and the current macOS malware landscape* Familiarity with macOS fleet management (MDM, configuration profiles, mobileconfig deployment)* Experience red teaming and performing attack emulation to bypass EDR on macOS* Proficiency with Swift. Additional understanding of Go, Python, and/or Ruby is preferred.* Experience with the MITRE ATT&CK matrix, Sigma, YARA, and Elasticsearch/Kibana* Track record of building POCs and carrying research from concept through to a shipped product capability* Experience leading data requirements work and tying it to cost/benefit analysis on collecting and storing only high-value telemetry* Commitment to clear written documentation of research findings* Comfortable reading Apple developer documentation, framework headers, and API references to answer undocumented questions* An understanding of how SMBs utilize IT automation tools such as PSAs and RMMs is strongly preferred* **Bonus**: Comfortable reverse engineering Mach-O binaries and scripted payloads using debuggers and a disassembler suite (Binary Ninja, IDA Pro, Hopper, or Ghidra)**What We Offer:*** 100% remote work environment – since our founding in 2015* Generous paid time off policy, including vacation, sick time, and paid holidays* 12 weeks of paid parental leave* Highly competitive and comprehensive medical, dental, and vision benefits plans* 401(k) with a 5% contribution regardless of employee contribution* Life and Disability insurance plans* Stock options for **all** full-time employees* One-time $500 reimbursement for building/upgrading home office* Annual allowance for education and professional development assistance* $75 USD/month digital reimbursement* Access to the BetterUp platform for coaching, personal, and professional growth*Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are.**We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status.**We do discriminate against hackers who try to exploit businesses of all sizes.***Accommodations:***If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to* *[e-mail]**. Please note that non-accommodation requests to this inbox will not receive a response.*