Principal macOS Security Researcher

Role overview Lead research that shapes security capabilities for macOS endpoints. The work spans system-level investigation, attack analysis, telemetry design, and turning prototypes into product features in partnership with detection, product, and engineering teams.

Responsibilities - Investigate macOS attacks, malware, and vulnerabilities through hands-on reproduction, detonation, and reverse engineering. - Prototype telemetry and capabilities using the Endpoint Security API and other macOS subsystems. - Assess Apple security frameworks and platform updates to find gaps in prevention, detection, and hardening. - Research offensive techniques and endpoint detection evasion; build proof-of-concept tools and methods. - Work with detection engineers to develop and tune detections, and with product and engineering teams to ship research outcomes. - Document findings, investigate false positives and false negatives, and mentor teammates on macOS security research.

Requirements - Deep knowledge of macOS internals, security controls, code signing, notarization, persistence, and Mach-O. - Hands-on experience with Endpoint Security API and system extension development. - Strong knowledge of macOS threats and attack methods, with red-team or attack-emulation experience. - Proficiency in Swift and experience taking proof-of-concept research into product capabilities. - Familiarity with MITRE ATT&CK, Sigma, YARA, Elasticsearch or Kibana, and macOS fleet management. - Able to read Apple developer documentation and write clear technical findings; experience balancing telemetry value against collection and storage costs.

Nice to have - Go, Python, or Ruby experience; familiarity with small-business IT automation tools. - Mach-O and scripted payload reverse engineering with debuggers or disassemblers.

Benefits and work setup - Remote role in the United States. - Paid vacation, sick time, holidays, and 12 weeks of parental leave; medical, dental, vision, life, and disability coverage. - Retirement contribution, stock options, home-office reimbursement, and annual professional development support.