SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
SafeBreach is seeking an EDR Evasion Specialist to join its offensive attack team. You will become the company's deepest expert on how modern endpoint security products detect and block adversary activity, and how real attackers circumvent them. Your work will translate this expertise into safe, production-grade attack content that enables enterprises to continuously validate their endpoint controls against today's threats.
In this hands-on development role, you will own the endpoint evasion research and development domain, tracking how leading EDR, XDR, and antivirus products detect attacker behavior while keeping the SafeBreach attack library ahead of emerging threats. You will research, prototype, and productize evasion techniques observed from real threat actors across Windows, Linux, and macOS, delivering them as safe, reversible, and measurable simulations.
You will build and maintain stealthy, stable attack components with strong emphasis on operational safety in customer environments. Collaboration is key: you'll partner with other attack developers and platform engineering teams to integrate your work into the SafeBreach simulator and post-breach propagation engine. You will also harness AI coding agents to accelerate research, tooling, and content delivery.
SafeBreach is the global leader in adversarial exposure validation (AEV), empowering organizations to operationalize the full CTEM lifecycle with its CTEM Platform. The company is backed by world-renowned threat researchers and provides enterprises with capabilities to understand threat exposure, make data-driven risk decisions, and measurably improve cyber resilience at scale.
The role reports to the Attack Team Leader and offers hybrid flexibility, quarterly recharge weekends, learning and development stipends, and generous paid leave policies including flexible PTO and parental leave.
REQUIREMENTS:
- 5+ years of hands-on offensive security work, with at least 3 years focused on endpoint defense evasion
- Expert-level understanding of OS internals and the mechanisms security products rely on for visibility
- Deep, practical knowledge of how commercial EDR products work, what they see, and where their coverage ends
- Strong C/C++ and Python skills; comfort with assembly and reverse engineering tools (IDA, Ghidra, WinDbg)
PREFERRED:
- Background in red teaming, adversary emulation, or APT simulation against mature, well-defended environments
- Experience on the defensive side: building detections, working at an EDR vendor, or tuning endpoint products
- Experience with MITRE ATT&CK and implementing or simulating ATT&CK techniques
- Understanding of modern threat actor TTPs and practical application in research environments
