Senior macOS Security Research Lead (Remote, Equity)

Saasventurecapital; America (AL); Remote; USD 215,000 - 225,000; Full time

Benefits offered by this job

100% remote work environment

Generous paid time off

12 weeks paid parental leave

Medical, dental, vision plans

401(k) with 5% contribution

Life and Disability insurance

Stock options for all full-time

Home office reimbursement $500

Education and professional development

Digital reimbursement $75

Job summary

Huntress, a remote-first cybersecurity company, seeks a seasoned macOS security researcher to lead product research on macOS protection strategies. You will prototype telemetry from Apple’s Endpoint Security API, reproduce attacks, and reverse‑engineer frameworks to improve detection and prevention.

The role emphasizes hands‑on malware analysis and collaboration with detection engineering. Remote US; base compensation range $215,000–$225,000 plus bonus and equity, with comprehensive benefits and

Qualifications

• Deep expertise in macOS system internals, including the security model, code signing and notarization, TCC, SIP, persistence, and the Mach‑O file format
• Hands‑on experience with Apple's Endpoint Security API and system extension development
• Authority on macOS security threats, attack techniques, and the current macOS malware landscape
• Familiarity with macOS fleet management (MDM, configuration profiles, mobileconfig deployment)
• Experience red teaming and performing attack emulation to bypass EDR on macOS
• Proficiency with Swift. Additional understanding of Go, Python, and/or Ruby is preferred.
• Experience with the MITRE ATT&CK matrix, Sigma, YARA, and Elasticsearch/Kibana
• Track record of building POCs and carrying research from concept through to a shipped product capability
• Experience leading data requirements work and tying it to cost/benefit analysis on collecting and storing only high‑value telemetry
• Commitment to clear written documentation of research findings

Responsibilities

• Lead product research initiatives that develop and evaluate macOS security product strategies and technologies
• Identify and prototype new telemetry from Apple's Endpoint Security API and other macOS subsystems to expand prevention, hardening, and detection capabilities
• Reproduce and analyze macOS attacks through hands‑on execution of attacker techniques, malware detonation, and vulnerability exploitation
• Reverse engineer macOS malware and Apple's own security frameworks (XProtect, XProtect Remediator, Gatekeeper, TCC) to identify coverage gaps and inform product direction
• Prototype and test new tools and methodologies for offensive operations against macOS endpoints, including EDR evasion and bypass research
• Build proof‑of‑concept implementations that demonstrate the feasibility of new capabilities
• Document research findings and collaborate with Detection Engineering on writing and tuning detectors
• Coordinate with Product and Engineering teams to integrate and operationalize solutions developed by Security teams
• Stand up episodic research environments and attacker infrastructure using cloud, VM, and container technologies
• Track Apple platform changes across beta and release cycles, and assess their impact on agent capability, telemetry, and detection coverage
• Identify and address gaps in macOS product coverage, including false positive and false negative investigations
• Develop internal and external technical documentation to educate customers and adjacent teams on macOS security risks and opportunities
• Mentor and teach across the team on macOS internals, malware analysis, and research methodology
• Promote Huntress' reputation through public speaking, CFPs, blogs, and media interaction

Skills

macOS internals

Endpoint Security API

Reverse engineering

Malware analysis

Swift

Go/Python/Ruby

Tools

Binary Ninja

IDA Pro

Hopper

Ghidra

Job description

Huntress, a remote-first cybersecurity company, seeks a seasoned macOS security researcher to lead product research on macOS protection strategies. You will prototype telemetry from Apple’s Endpoint Security API, reproduce attacks, and reverse‑engineer frameworks to improve detection and prevention.

The role emphasizes hands‑on malware analysis and collaboration with detection engineering. Remote US; base compensation range $215,000–$225,000 plus bonus and equity, with comprehensive benefits and