Security Researcher

Iru•Miami, FL

2d•Hybrid

About The Position

Iru is hiring a Security Researcher for its Threat Intelligence and Research team, focused on detection engineering for Windows and macOS. The role owns detections end to end: researching adversary behavior, developing file-based and behavioral detection logic, validating it, and shipping it into Iru’s EDR product. Research includes malware reverse engineering, threat hunting, and identifying gaps in detection coverage. The researcher will also contribute intelligence research to Iru’s Vulnerability product by improving public vulnerability data and researching vendor software naming, versioning, and distribution so that reported vulnerabilities match customers’ installed software accurately. The role includes building and maintaining research and detection tooling, collaborating with engineering on agent telemetry and detection integration, reviewing teammates’ work, and sharing findings through publications and conference talks. The position offers significant ownership within a small team and a direct impact on research and product direction.

Requirements

3–5 years of cybersecurity experience with a hands-on focus on detection engineering and malware analysis.
Strong Windows expertise; working familiarity with macOS and willingness to deepen expertise in it.
Proven experience building file-based and behavioral endpoint detections using YARA and Sigma and shipping them into a product or production environment.
Experience taking detections from research through testing and release, and maintaining them as adversary behavior changes.
Strong understanding of Windows and macOS internals and endpoint security mechanisms, including ETW, kernel callbacks, and Endpoint Security APIs, and the telemetry they produce.
Working knowledge of adversary tradecraft and detection coverage frameworks such as MITRE ATT&CK.
Experience with malware analysis tools and techniques, such as Binary Ninja, Ghidra, IDA, WinDbg, Sysinternals, or Mac Monitor.
Experience hunting with threat intelligence platforms such as VirusTotal, Google Threat Intelligence, or equivalents, including retrohunting and hunting rule development.
Working knowledge of the CVE and vulnerability data ecosystem, including NVD, vendor advisories, CPE, and version matching, with the ability to identify incomplete, ambiguous, or inaccurate data.
Proficiency with security-focused scripting and data analysis using Python, PowerShell, Bash, and SQL, and comfort working with large sample sets.
Demonstrated ability to communicate research externally through blog posts, conference talks, or published work.

Nice To Haves

Experience developing or contributing to EDR or next-generation antivirus products.
Experience with detection-as-code practices, including version-controlled rules, peer review, and automated rule testing.
Experience using AI tools to accelerate threat research, detection development, and analysis workflows.
Experience applying machine learning or statistical methods to malware classification, including building and evaluating labeled sample corpora.
Experience with malware detonation environments, sandboxing, or automated dynamic analysis.
Familiarity with Windows and macOS threat landscapes and platform-specific attack techniques.
Ability to assess and prioritize vulnerabilities using industry-standard frameworks and data sources, including severity scoring, exploit prediction, and known-exploited catalogs.

Responsibilities

Own detections end to end, from behavioral research and logic development through validation and release into the EDR product.
Develop and enhance file-based and behavioral detections for Windows and macOS using YARA, Sigma, and internal behavioral rule formats.
Analyze malware and adversarial behavior across Windows and macOS to identify detection opportunities.
Map detection coverage to MITRE ATT&CK and real-world campaigns, identify gaps, and prioritize detection work.
Test and validate detections against real samples and emulated adversary behavior before customer release.
Assess agent telemetry and identify event sources and sensor capabilities needed to support detections.
Collaborate with engineering teams to integrate detection logic into the cross-platform security agent.
Hunt for emerging threats using threat intelligence platforms, including retrohunts, livehunts, and hunting rule development, and turn findings into shipped coverage.
Triage newly disclosed CVEs and enrich or correct public vulnerability data, including affected version ranges, product and vendor naming, and advisory gaps or inconsistencies.
Research how vendors version, name, and distribute software and develop vulnerability detection methods that match real-world software inventories.
Build and maintain analysis pipelines, threat monitoring, sample processing, and rule-testing workflows.
Monitor emerging threats and trends across Windows and macOS and provide research-driven product recommendations.
Review teammates’ detection content and help improve the team’s quality standards.
Write blog posts, present findings at industry conferences, and document research for internal and external audiences.