SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 215,000 - 225,000 / annual
Huntress, founded in 2015 by former NSA cyber operators, is seeking a Principal macOS Security Researcher to lead product research initiatives that develop and evaluate macOS security strategies and technologies. You will work remotely as part of a team securing over 5M endpoints and 16M identities worldwide.
In this role, you will identify and prototype new telemetry from Apple's Endpoint Security API and macOS subsystems to expand prevention, hardening, and detection capabilities. You'll reproduce and analyze macOS attacks through hands-on execution of attacker techniques, malware detonation, and vulnerability exploitation. A key responsibility is reverse engineering macOS malware and Apple's security frameworks (XProtect, XProtect Remediator, Gatekeeper, TCC) to identify coverage gaps and inform product direction.
You will prototype and test new tools and methodologies for offensive operations against macOS endpoints, including EDR evasion and bypass research, and build proof-of-concept implementations demonstrating feasibility of new capabilities. You'll document research findings and collaborate with Detection Engineering on writing and tuning detectors, then coordinate with Product and Engineering teams to integrate solutions. Additional responsibilities include standing up ephemeral research environments using cloud, VM, and container technologies; tracking Apple platform changes across beta and release cycles; identifying and addressing gaps in macOS product coverage; developing internal and external technical documentation; mentoring team members on macOS internals and malware analysis; and promoting Huntress' reputation through public speaking, conference submissions, blogs, and media interaction.
REQUIREMENTS:
- Deep expertise in macOS system internals (security model, code signing, notarization, TCC, SIP, persistence, Mach-O file format)
- Hands-on experience with Apple's Endpoint Security API and system extension development
- Authority on macOS security threats, attack techniques, and current macOS malware landscape
- Familiarity with macOS fleet management (MDM, configuration profiles, mobileconfig deployment)
- Experience red teaming and performing attack emulation to bypass EDR on macOS
- Proficiency with Swift; additional understanding of Go, Python, and/or Ruby preferred
- Experience with MITRE ATT&CK matrix, Sigma, YARA, and Elasticsearch/Kibana
- Track record of building POCs and carrying research from concept through shipped product capability
- Experience leading data requirements work and tying it to cost/benefit analysis on telemetry collection and storage
- Commitment to clear written documentation of research findings
- Comfortable reading Apple developer documentation, framework headers, and API references
- Understanding of how SMBs utilize IT automation tools (PSAs and RMMs) strongly preferred
- Bonus: Comfortable reverse engineering Mach-O binaries using debuggers and disassembler suite (Binary Ninja, IDA Pro, Hopper, or Ghidra)
