Security Researcher

Iru•Miami, FL

16h•Hybrid

About The Position

Iru is hiring a Security Researcher for its small Threat Intelligence and Research team, focused on detection engineering for Windows and macOS. The role owns detections from adversary research through implementation, validation, and release into Iru’s EDR product. Work includes reverse engineering malware, identifying emerging threats and coverage gaps, and developing file-based and behavioral detection logic. The researcher also contributes intelligence work to Iru’s Vulnerability product by improving public vulnerability data and building accurate methods for matching vulnerabilities to installed software. The role includes developing supporting tools and automation, communicating research through publications and conference talks, and influencing product and research direction. The work is in a hybrid environment with three days in the office per week.

Requirements

3–5 years of cybersecurity experience with a hands-on focus on detection engineering and malware analysis.
Strong Windows expertise; working familiarity with macOS and willingness to deepen that expertise.
Demonstrated experience building file-based and behavioral endpoint detections using YARA and Sigma and shipping them into a product or production environment.
Experience taking detections from research through testing and release, and maintaining them as adversary behavior changes.
Strong understanding of Windows and macOS internals and endpoint security mechanisms, including ETW, kernel callbacks, and Endpoint Security APIs, as well as the telemetry they produce.
Working knowledge of adversary tradecraft and detection coverage frameworks such as MITRE ATT&CK.
Experience with malware analysis tools and techniques, such as Binary Ninja, Ghidra, IDA, WinDbg, Sysinternals, or Mac Monitor.
Experience hunting with threat intelligence platforms such as VirusTotal, Google Threat Intelligence, or equivalent, including retrohunting and hunting rule development.
Working knowledge of the CVE and vulnerability data ecosystem, including NVD, vendor advisories, CPE, and version matching, and ability to identify incomplete, ambiguous, or incorrect data.
Proficiency with security-focused scripting and data analysis using Python, PowerShell, Bash, and SQL, and comfort working with large sample sets.
Ability to communicate research externally through blog posts, conference talks, or published work.

Nice To Haves

Experience developing or contributing to EDR or next-generation antivirus products.
Experience with detection-as-code practices, including version-controlled rules, peer review, and automated rule testing.
Experience using AI tools to accelerate threat research, detection development, and analysis workflows.
Experience applying machine learning or statistical methods to malware classification, including building and evaluating labeled sample corpora.
Experience with malware detonation environments, sandboxing, or automated dynamic analysis.
Familiarity with Windows and macOS threat landscapes and platform-specific attack techniques.
Ability to assess and prioritize vulnerabilities using industry-standard frameworks and data sources, including severity scoring, exploit prediction, and known-exploited catalogs.

Responsibilities

Own detections end to end by researching behavior, writing detection logic, validating it, and shipping it into the EDR product.
Develop and enhance file-based and behavioral detections for Windows and macOS using YARA, Sigma, and Iru’s behavioral rule formats.
Analyze malware and adversarial behavior across Windows and macOS to identify detection opportunities.
Map detection coverage to MITRE ATT&CK and real-world campaigns, identify gaps, and prioritize detection work.
Test and validate detections against real samples and emulated adversary behavior before release.
Assess agent telemetry and identify event sources and sensor capabilities needed to detect observed behavior.
Collaborate with engineering teams to integrate detection logic into the cross-platform security agent.
Hunt for emerging threats using threat intelligence platforms, including retrohunts, livehunts, and hunting rule development, and turn findings into shipped coverage.
Triage newly disclosed CVEs and enrich or correct public vulnerability data, including affected version ranges, product and vendor naming, and advisory gaps or inconsistencies.
Research how vendors version, name, and distribute software, and develop vulnerability detection methods that accurately match real-world inventories.
Build and maintain analysis pipelines, threat monitoring, sample processing, and rule-testing tools and automation.
Monitor emerging threats and trends across Windows and macOS and provide research-driven recommendations for the product roadmap.
Review teammates’ detection content and help improve the team’s quality standards.
Write blog posts, present findings at industry conferences, and document research for internal and external audiences.