[Hiring] Principal macOS Security Researcher @Huntress

Role Description

Lead product research initiatives that develop and evaluate macOS security product strategies and technologies.

• Identify and prototype new telemetry from Apple's Endpoint Security API and other macOS subsystems to expand prevention, hardening, and detection capabilities.
• Reproduce and analyze macOS attacks through hands-on execution of attacker techniques, malware detonation, and vulnerability exploitation.
• Reverse engineer macOS malware and Apple's own security frameworks (XProtect, XProtect Remediator, Gatekeeper, TCC) to identify coverage gaps and inform product direction.
• Prototype and test new tools and methodologies for offensive operations against macOS endpoints, including EDR evasion and bypass research.
• Build proof-of-concept implementations that demonstrate the feasibility of new capabilities.
• Document research findings and collaborate with Detection Engineering on writing and tuning detectors.
• Coordinate with Product and Engineering teams to integrate and operationalize solutions developed by Security teams.
• Stand up ephemeral research environments and attacker infrastructure using cloud, VM, and container technologies.
• Track Apple platform changes across beta and release cycles, and assess their impact on agent capability, telemetry, and detection coverage.
• Identify and address gaps in macOS product coverage, including false positive and false negative investigations.
• Develop internal and external technical documentation to educate customers and adjacent teams on macOS security risks and opportunities.
• Mentor and teach across the team on macOS internals, malware analysis, and research methodology.
• Promote Huntress' reputation through public speaking, CFPs, blogs, and media interaction.

Qualifications

• Deep expertise in macOS system internals, including the security model, code signing and notarization, TCC, SIP, persistence, and the Mach-O file format.
• Hands-on experience with Apple's Endpoint Security API and system extension development.
• Authority on macOS security threats, attack techniques, and the current macOS malware landscape.
• Familiarity with macOS fleet management (MDM, configuration profiles, mobileconfig deployment).
• Experience red teaming and performing attack emulation to bypass EDR on macOS.
• Proficiency with Swift. Additional understanding of Go, Python, and/or Ruby is preferred.
• Experience with the MITRE ATT&CK matrix, Sigma, YARA, and Elasticsearch/Kibana.
• Track record of building POCs and carrying research from concept through to a shipped product capability.
• Experience leading data requirements work and tying it to cost/benefit analysis on collecting and storing only high-value telemetry.
• Commitment to clear written documentation of research findings.
• Comfortable reading Apple developer documentation, framework headers, and API references to answer undocumented questions.
• An understanding of how SMBs utilize IT automation tools such as PSAs and RMMs is strongly preferred.

Requirements

• Comfortable reverse engineering Mach-O binaries and scripted payloads using debuggers and a disassembler suite (Binary Ninja, IDA Pro, Hopper, or Ghidra).

Benefits

• 100% remote work environment - since our founding in 2015.
• Generous paid time off policy, including vacation, sick time, and paid holidays.
• 12 weeks of paid parental leave.
• Highly competitive and comprehensive medical, dental, and vision benefits plans.
• 401(k) with a 5% contribution regardless of employee contribution.
• Life and Disability insurance plans.
• Stock options for all full-time employees.
• One-time $500 reimbursement for building/upgrading home office.
• Annual allowance for education and professional development assistance.
• $75 USD/month digital reimbursement.
• Access to the BetterUp platform for coaching, personal, and professional growth.