Principal macOS Security Researcher

Huntress

4d•$215,000 - $225,000•Remote

About The Position

Huntress is a remote-first team founded in 2015 by former NSA cyber operators, dedicated to making enterprise-grade cybersecurity accessible to businesses of all sizes. We collaborate closely with security teams and service providers who protect complex environments, often facing resource constraints. To address this, we develop our technology in-house and support it with a 24/7 human-led Security Operations Center (SOC), ensuring continuous expert oversight. Huntress currently secures over 5 million endpoints and 16 million identities globally, a number that continues to grow as more businesses trust us to help manage their security burdens and operate with greater confidence. Our commitment is evident daily in how we support our customers and each other.

Requirements

Deep expertise in macOS system internals, including the security model, code signing and notarization, TCC, SIP, persistence, and the Mach-O file format
Hands-on experience with Apple's Endpoint Security API and system extension development
Authority on macOS security threats, attack techniques, and the current macOS malware landscape
Familiarity with macOS fleet management (MDM, configuration profiles, mobileconfig deployment)
Experience red teaming and performing attack emulation to bypass EDR on macOS
Proficiency with Swift. Additional understanding of Go, Python, and/or Ruby is preferred.
Experience with the MITRE ATT&CK matrix, Sigma, YARA, and Elasticsearch/Kibana
Track record of building POCs and carrying research from concept through to a shipped product capability
Experience leading data requirements work and tying it to cost/benefit analysis on collecting and storing only high-value telemetry
Commitment to clear written documentation of research findings
Comfortable reading Apple developer documentation, framework headers, and API references to answer undocumented questions

Nice To Haves

An understanding of how SMBs utilize IT automation tools such as PSAs and RMMs is strongly preferred
Comfortable reverse engineering Mach-O binaries and scripted payloads using debuggers and a disassembler suite (Binary Ninja, IDA Pro, Hopper, or Ghidra)

Responsibilities

Lead product research initiatives that develop and evaluate macOS security product strategies and technologies
Identify and prototype new telemetry from Apple's Endpoint Security API and other macOS subsystems to expand prevention, hardening, and detection capabilities
Reproduce and analyze macOS attacks through hands-on execution of attacker techniques, malware detonation, and vulnerability exploitation
Reverse engineer macOS malware and Apple's own security frameworks (XProtect, XProtect Remediator, Gatekeeper, TCC) to identify coverage gaps and inform product direction
Prototype and test new tools and methodologies for offensive operations against macOS endpoints, including EDR evasion and bypass research
Build proof-of-concept implementations that demonstrate the feasibility of new capabilities
Document research findings and collaborate with Detection Engineering on writing and tuning detectors
Coordinate with Product and Engineering teams to integrate and operationalize solutions developed by Security teams
Stand up ephemeral research environments and attacker infrastructure using cloud, VM, and container technologies
Track Apple platform changes across beta and release cycles, and assess their impact on agent capability, telemetry, and detection coverage
Identify and address gaps in macOS product coverage, including false positive and false negative investigations
Develop internal and external technical documentation to educate customers and adjacent teams on macOS security risks and opportunities
Mentor and teach across the team on macOS internals, malware analysis, and research methodology
Promote Huntress' reputation through public speaking, CFPs, blogs, and media interaction