Remote macOS Security Research Lead

Huntress; United States; Remote; USD 215,000 - 225,000; Full time

Benefits offered by this job

Remote work

Stock options

Paid time off

Parental leave

Medical, dental, vision benefits

401(k) with 5% match

Home office stipend

Education development allowance

Coaching access

Job summary

Huntress is seeking a Senior macOS Security Researcher to lead research on macOS internals, telemetry, and detection capabilities. You’ll prototype new tools, analyze attacks, and collaborate with Detection Engineering to operationalize findings.

You will mentor teammates, document research thoroughly, and contribute to public speaking and writing to promote Huntress’ leadership in macOS defense.

Qualifications

• Expertise in macOS internals, security model, and notarization.
• Hands-on experience with Apple's Endpoint Security API and system extensions.
• Proficient in macOS threat research and malware analysis.
• Experience with macOS fleet management (MDM, config profiles).
• Experience red teaming and bypassing EDR on macOS.
• Proficiency in Swift; knowledge of Go, Python, or Ruby preferred.
• Familiar with MITRE ATT&CK, Sigma, YARA, and Elasticsearch/Kibana.
• Track record of building POCs and shipping capabilities.
• Experience leading data requirements and telemetry selection.
• Excellent written documentation.

Responsibilities

• Lead product research initiatives that develop and evaluate macOS security product strategies and technologies.
• Identify and prototype new telemetry from Apple's Endpoint Security API and other macOS subsystems to expand prevention, hardening, and detection capabilities.
• Reproduce and analyze macOS attacks through hands-on execution of attacker techniques, malware detonation, and vulnerability exploitation.
• Reverse engineer macOS malware and Apple's security frameworks to identify coverage gaps and inform product direction.
• Prototype and test new tools and methodologies for offensive operations against macOS endpoints, including EDR evasion and bypass research.
• Build proof-of-concept implementations demonstrating new capabilities.
• Document research findings and collaborate with Detection Engineering on detectors.
• Coordinate with Product and Engineering to integrate solutions developed by Security teams.
• Stand up fleeting research environments and attacker infrastructure using cloud, VM, and container tech.
• Track Apple platform changes across beta and release cycles and assess impact on agent capability and detection.

Skills

macOS internals

Swift

Go

Python

Ruby

Red teaming

MITRE ATT&CK

Threat research

Documentation

Tools

Apple Endpoint Security API

Binary Ninja

IDA Pro

Hopper

Ghidra

Elasticsearch

Kibana

XProtect

XProtect Remediator

Gatekeeper

TCC

Job description

Huntress is seeking a Senior macOS Security Researcher to lead research on macOS internals, telemetry, and detection capabilities. You’ll prototype new tools, analyze attacks, and collaborate with Detection Engineering to operationalize findings.

You will mentor teammates, document research thoroughly, and contribute to public speaking and writing to promote Huntress’ leadership in macOS defense.