← All roles

Principal macOS Security Researcher

Huntress· Product Research
Apply on company site
Remote$215k - $225kPosted 1w ago

About the role

Remote-first cybersecurity research role focusing on macOS security research, telemetry, detection, and product integration within Huntress.

Responsibilities

  • Lead product research initiatives that develop and evaluate macOS security product strategies and technologies
  • Identify and prototype new telemetry from Apple's Endpoint Security API and other macOS subsystems to expand prevention, hardening, and detection capabilities
  • Reproduce and analyze macOS attacks through hands-on execution of attacker techniques, malware detonation, and vulnerability exploitation
  • Reverse engineer macOS malware and Apple's own security frameworks (XProtect, XProtect Remediator, Gatekeeper, TCC) to identify coverage gaps and inform product direction
  • Prototype and test new tools and methodologies for offensive operations against macOS endpoints, including EDR evasion and bypass research
  • Build proof-of-concept implementations that demonstrate the feasibility of new capabilities
  • Document research findings and collaborate with Detection Engineering on writing and tuning detectors
  • Coordinate with Product and Engineering teams to integrate and operationalize solutions developed by Security teams
  • Stand up ephemeral research environments and attacker infrastructure using cloud, VM, and container technologies
  • Track Apple platform changes across beta and release cycles, and assess their impact on agent capability, telemetry, and detection coverage
  • Identify and address gaps in macOS product coverage, including false positive and false negative investigations
  • Develop internal and external technical documentation to educate customers and adjacent teams on macOS security risks and opportunities
  • Mentor and teach across the team on macOS internals, malware analysis, and research methodology
  • Promote Huntress' reputation through public speaking, CFPs, blogs, and media interaction

Qualifications

  • Deep expertise in macOS system internals, including the security model, code signing and notarization, TCC, SIP, persistence, and the Mach-O file format
  • Hands-on experience with Apple's Endpoint Security API and system extension development
  • Authority on macOS security threats, attack techniques, and the current macOS malware landscape
  • Familiarity with macOS fleet management (MDM, configuration profiles, mobileconfig deployment)
  • Experience red teaming and performing attack emulation to bypass EDR on macOS
  • Proficiency with Swift. Additional understanding of Go, Python, and/or Ruby is preferred.
  • Experience with the MITRE ATT&CK matrix, Sigma, YARA, and Elasticsearch/Kibana
  • Track record of building POCs and carrying research from concept through to a shipped product capability
  • Experience leading data requirements work and tying it to cost/benefit analysis on collecting and storing only high-value telemetry
  • Commitment to clear written documentation of research findings
  • Comfortable reading Apple developer documentation, framework headers, and API references to answer undocumented questions
  • An understanding of how SMBs utilize IT automation tools such as PSAs and RMMs is strongly preferred
  • Bonus: Comfortable reverse engineering Mach-O binaries and scripted payloads using debuggers and a disassembler suite (Binary Ninja, IDA Pro, Hopper, or Ghidra)

Skills

Required:macOS internalsEndpoint Security APImacOS malware analysisSwift
Nice to have:EDR bypass / red teaming

Benefits

  • 100% remote work environment
  • Generous paid time off policy including vacation, sick time, and paid holidays
  • 12 weeks of paid parental leave
  • Medical, dental, and vision benefits plans
  • 401(k) with a 5% contribution
  • Life and Disability insurance plans
  • Stock options for all full-time employees
  • One-time $500 reimbursement for building/upgrading home office
  • Annual education and professional development allowance
  • $75 USD/month digital reimbursement
  • Access to BetterUp for coaching and growth
Last updated Oct 22, 2026. Interested? Apply on the company site.

About Huntress

Enterprise-grade cybersecurity for ALL businesses.

Stop cyberattacks with the Huntress Managed Platform. Get 24/7 SOC-backed EDR, ITDR, SIEM, & Security Awareness Training for enterprise-grade protection across all your environments

cybersecurityendpoint protectionEDRITDRSIEMSecurity Awareness Training
Company profileWebsite

More open roles at Huntress