Remote Principal macOS Security Researcher - Lead Detection

Jobicy; United States; Remote; USD 215,000 - 225,000; Full time

Benefits offered by this job

Remote work

Paid time off

Parental leave

Medical/Dental/Vision benefits

401(k)

Stock options

Home office reimbursement

Education allowance

Digital reimbursement

Coaching access

Job summary

Huntress seeks a principal macOS security researcher to lead research expanding endpoint protection, telemetry, and detection capabilities. You’ll combine deep macOS internals expertise with malware analysis, attack emulation, and PoC development, partnering with Detection Engineering, Product, and Engineering to ship capabilities.

You’ll mentor the team, publish technical docs, track Apple platform changes, and contribute to public thought leadership while defending SMB endpoints on a

Qualifications

• Deep expertise in macOS internals, security model, and code signing.
• Experience with Endpoint Security API and system extension development.
• Authority on macOS threats, attack techniques, and malware landscape.
• Familiarity with fleet management and SMB IT automation tools is preferred.

Responsibilities

• Lead macOS security research to expand prevention, hardening, telemetry and detection.
• Prototype telemetry from Apple’s Endpoint Security API and subsystems.
• Reproduce and analyze macOS attacks through hands-on execution and detonation.
• Reverse engineer macOS malware and Apple security frameworks to close coverage gaps.
• Mentor teammates and contribute to public thought leadership and detectors.

Skills

macOS security research

macOS system internals

Apple Endpoint Security API

Malware reverse engineering

EDR evasion research

Swift

MITRE ATT&CK

Sigma rules

YARA

Elasticsearch/Kibana

Tools

Binary Ninja

IDA Pro

Hopper

Ghidra

Go

Python

Ruby

Job description

Huntress seeks a principal macOS security researcher to lead research expanding endpoint protection, telemetry, and detection capabilities. You’ll combine deep macOS internals expertise with malware analysis, attack emulation, and PoC development, partnering with Detection Engineering, Product, and Engineering to ship capabilities.

You’ll mentor the team, publish technical docs, track Apple platform changes, and contribute to public thought leadership while defending SMB endpoints on a