Security Researcher

Iru; Miami (FL); Hybrid; USD 120,000 - 160,000; Full time

Benefits offered by this job

Competitive salary

Hybrid work environment (3 days in in‑

100% medical + dental + vision

401(k) with company match

PTO 20 days

Equity for full-time employees

In-office lunch stipend

Paid family and medical leave

Onsite fitness center

Free parking

Job summary

Iru is seeking a Security Researcher focused on detection engineering for Windows and macOS to join our Threat Intelligence and Research team. You’ll own detections end to end—from research to shipping into our EDR product—with file-based and behavioral logic and strong emphasis on validating and refining detections.

You’ll reverse engineer malware, hunt for threats, and contribute to our Vulnerability product by refining public data.

Qualifications

• 3–5 years of experience in cybersecurity with a hands-on focus on detection engineering and malware analysis.
• Depth on Windows with willingness to grow macOS expertise.
• Experience building file-based and behavioral detections for endpoints (YARA, Sigma) and shipping them into a product or production environment.
• Experience taking a detection from research through testing and release, maintaining it over time as adversary behavior changes.
• Strong understanding of OS internals and endpoint security mechanisms on Windows and macOS.
• Familiarity with MITRE ATT&CK and threat tradecraft.

Responsibilities

• Own detections end to end: research the behavior, write the logic, validate it, and ship it into our EDR product.
• Develop and enhance file-based and behavioral detections for Windows and macOS (YARA, Sigma, and our own rule formats).
• Analyze malware and adversarial behavior to identify detection opportunities across platforms.
• Map coverage against adversary tradecraft and prioritize what to build next.
• Test detections against real samples and emulated behavior before release to customers.
• Work with telemetry from our agent to identify needed events and sensor capabilities.
• Collaborate with engineering to integrate detection logic into cross-platform agent.
• Hunt for threats using threat intel platforms and turn findings into coverage.
• Contribute to Vulnerability product by triaging CVEs and enriching data.
• Research how vendors version and distribute software to improve vulnerability reporting.
• Build tooling and automation for analysis pipelines and rule testing workflows.
• Monitor emerging threats and surface research-driven roadmap suggestions.
• Review teammates’ detection content and raise quality levels.
• Author blog posts and present findings at conferences.

Skills

Detection engineering

Malware analysis

Windows OS internals

macOS internals

YARA

Sigma

Python

PowerShell

Bash

SQL

Threat intelligence

Tools

Binary Ninja

Ghidra

IDA

WinDbg

Sysinternals

Mac Monitor

Job description

About Iru

Iru is the AI-powered security & IT platform used by the world’s fastest-growing companies to secure their users, apps, and devices. Built for the AI era, Iru unifies identity & access, endpoint security & management, and compliance automation—collapsing the stack and giving IT & security time and control back.

Iru is backed by some of the smartest investors in tech—General Catalyst, Tiger Global, Felicis, Greycroft, and First Round Capital. In July 2024, Iru raised $100 million from General Catalyst, valuing the company at $850 million. Customers include Cursor, Vercel, Bumble, Plaid, Glean, Apollo, Replit, and Mercor, and Iru partners with industry leaders such as ServiceNow and AWS. Iru was named to Forbes’ America’s Best Startup Employers 2025 list for employee engagement and satisfaction.

Role Overview

We are looking for a Security Researcher focused on detection engineering for Windows and macOS to join our small, focused Threat Intelligence and Research team. You’ll own detections end to end: researching adversary behavior, turning that research into file-based and behavioral detection logic, validating it, and shipping it into our EDR product.

Detection engineering is the core of the role, and the research that feeds it is yours to drive: reverse engineering malware, hunting for emerging threats, and finding where our coverage falls short. You’ll also contribute to our Vulnerability product, where the work is intelligence rather than discovery. You’ll research how vendors version and distribute their software, correct the gaps and errors in public vulnerability data, and make sure what we report as vulnerable matches what customers actually have installed.

You’ll build the tooling your detection work depends on, and help raise the team’s external profile through published research and conference talks. As part of a small team, you’ll have significant ownership over your work and a direct impact on the direction of our research and products.

Key Responsibilities

• Own detections end to end: research the behavior, write the logic, validate it, and ship it into our EDR product.
• Develop and enhance file-based and behavioral detections for Windows and macOS (YARA, Sigma, and our own behavioral rule formats).
• Perform in-depth analysis of malware and adversarial behavior across both platforms to identify detection opportunities.
• Map detection coverage against adversary tradecraft (MITRE ATT&CK and real-world campaigns), find the gaps, and prioritize what to build next.
• Test and validate detections against real samples and emulated adversary behavior before they reach customers.
• Work with the telemetry our agent collects, and tell engineering when it isn’t enough: identify the event sources and sensor capabilities needed to detect what you’re seeing.
• Collaborate with engineering teams to incorporate detection logic into our cross-platform security agent.
• Hunt for new and emerging threats using threat intelligence platforms (retrohunts, livehunts, and hunting rule development), and turn what you find into shipped coverage.
• Contribute to our Vulnerability product as an intelligence researcher: triage newly disclosed CVEs, then enrich and correct the public data behind them (affected version ranges, product and vendor naming, advisory gaps and inconsistencies) so that we report as vulnerable reflects reality.
• Research how vendors version, name, and distribute their software, and develop vulnerability detection methods that match accurately against real-world software inventories.
• Build and maintain the tooling and automation your work depends on: analysis pipelines, threat monitoring, sample processing, and rule testing workflows.
• Continuously monitor emerging threats and trends across Windows and macOS ecosystems, and surface research-driven recommendations into the product roadmap.
• Review teammates’ detection content and help raise the quality bar across the team.
• Author blog posts and present findings at industry conferences, and document research clearly for both internal and external audiences.

Qualifications

• 3–5 years of experience in cybersecurity, with a hands-on focus on detection engineering and malware analysis. Depth on Windows is what the team most needs today; working familiarity with macOS and a willingness to build depth there is expected.
• Proven track record building file-based and behavioral detections for endpoints (YARA, Sigma) and shipping them into a product or production environment.
• Experience taking a detection from research through testing and release, and maintaining it over time as adversary behavior changes.
• Strong understanding of OS internals and endpoint security mechanisms on Windows and macOS (ETW and kernel callbacks, Endpoint Security APIs), and of the telemetry they produce.
• Working knowledge of adversary tradecraft and detection coverage frameworks (MITRE ATT&CK).
• Experience with malware analysis tools and techniques (Binary Ninja, Ghidra, IDA, WinDbg, Sysinternals, or Mac Monitor).
• Experience hunting with threat intelligence platforms (VirusTotal, Google Threat Intelligence, or equivalent), including retrohunting and hunting rule development.
• Working knowledge of the CVE and vulnerability data ecosystem (NVD, vendor advisories, CPE and version matching), and a critical eye for where that data is incomplete, ambiguous, or simply wrong.
• Proficiency with security-focused scripting and data analysis (Python, PowerShell, Bash, SQL), and comfort working with large sample sets.
• Demonstrated ability to communicate research externally through blog posts, conference talks, or published work.

Preferred Qualifications

• Experience developing or contributing to EDR or next-gen antivirus products.
• Experience with detection-as-code practices: version-controlled rules, peer review, and automated rule testing.
• Experience leveraging AI tools to accelerate threat research, detection development, and analysis workflows.
• Experience applying machine learning or statistical methods to malware classification, including building and evaluating against labeled sample corpora.
• Experience with malware detonation environments, sandboxing, or automated dynamic analysis.
• Familiarity with both Windows and macOS threat landscapes and platform-specific attack techniques.
• Demonstrated ability to assess and prioritize vulnerabilities using industry-standard frameworks and data sources (severity scoring, exploit prediction, known-exploited catalogs).

Benefits & Perks

Competitive salary

Hybrid work environment (3 days in office per week)

100% individual and dependent medical + dental + vision coverage

401(K) with a 4% company match

20 days PTO

Iru Wellness Week the first week in July

Equity for full-time employees

In-office lunch stipend provided

Up to 16 weeks of paid leave for new parents

Paid Family and Medical Leave

Modern Health mental health benefits for individuals and dependents

Fertility benefits

Working Advantage employee discounts

Onsite fitness center

Free parking

Exciting opportunities for career growth

We are excited to be serving a significant need for a fast-growing market, and are proud of the high-performing team we have brought together so far.

At Iru, we believe in fostering an inclusive environment in which employees feel encouraged to share their unique perspectives, leverage their strengths, and act authentically. We know that diverse teams are strong teams, and welcome those from all backgrounds and varying experiences.

Iru is proud to be an equal opportunity employer committed to diversity and inclusion in the workplace. Qualified applicants will be considered for employment without regard to race, color, religion, national origin, age, sex, sexual orientation, gender identity, physical or mental disability, protected veteran or military status or any other status protected by applicable law. #LI-Hybrid