{"id":2201790,"url":"https://alion.io/job/huntress-principal-macos-security-researcher","title":"Principal macOS Security Researcher","company":{"id":2007,"name":"Huntress","domain":"huntress.com","url":"https://alion.io/company/huntress","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":75,"open_postings":9,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":30,"computed_at":"2026-11-05T05:54:30Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":215000,"max":null,"currency":"USD","period":"year","gross":null,"usd_annual":215000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"Binary Ninja","optional":false},{"name":"ElasticSearch","optional":false},{"name":"Ghidra","optional":false},{"name":"Go","optional":false},{"name":"IDA Pro","optional":false},{"name":"Kibana","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"Ruby","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false},{"name":"Assembly","optional":true}],"status":"live","first_seen_at":"2026-10-09T19:08:47Z","employer_posted_date":"2026-10-21","last_verified_at":"2026-11-05T08:31:45Z","board_verified":true,"closed_at":null,"days_open":26,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":26},"description":"What We Do:\nCybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact.\nFounded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection.\nHuntress now secures more than 6M endpoints and 16M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other.\nReports to: Manager, Product Research\nLocation: Remote US\nCompensation Range: $215,000.00 to$225,000.00 base plus bonus and equity\nWhat You’ll Do: \nLead product research initiatives that develop and evaluate macOS security product strategies and technologies\nIdentify and prototype new telemetry from Apple's Endpoint Security API and other macOS subsystems to expand prevention, hardening, and detection capabilities\nReproduce and analyze macOS attacks through hands-on execution of attacker techniques, malware detonation, and vulnerability exploitation\nReverse engineer macOS malware and Apple's own security frameworks (XProtect, XProtect Remediator, Gatekeeper, TCC) to identify coverage gaps and inform product direction\nPrototype and test new tools and methodologies for offensive operations against macOS endpoints, including EDR evasion and bypass research\nBuild proof-of-concept implementations that demonstrate the feasibility of new capabilities\nDocument research findings and collaborate with Detection Engineering on writing and tuning detectors\nCoordinate with Product and Engineering teams to integrate and operationalize solutions developed by Security teams\nStand up ephemeral research environments and attacker infrastructure using cloud, VM, and container technologies\nTrack Apple platform changes across beta and release cycles, and assess their impact on agent capability, telemetry, and detection coverage\nIdentify and address gaps in macOS product coverage, including false positive and false negative investigations\nDevelop internal and external technical documentation to educate customers and adjacent teams on macOS security risks and opportunities\nMentor and teach across the team on macOS internals, malware analysis, and research methodology\nPromote Huntress' reputation through public speaking, CFPs, blogs, and media interaction\nWhat You Bring To The Team: \nDeep expertise in macOS system internals, including the security model, code signing and notarization, TCC, SIP, persistence, and the Mach-O file format\nHands-on experience with Apple's Endpoint Security API and system extension development\nAuthority on macOS security threats, attack techniques, and the current macOS malware landscape\nFamiliarity with macOS fleet management (MDM, configuration profiles, mobileconfig deployment)\nExperience red teaming and performing attack emulation to bypass EDR on macOS\nProficiency with Swift. Additional understanding of Go, Python, and/or Ruby is preferred.\nExperience with the MITRE ATT&CK matrix, Sigma, YARA, and Elasticsearch/Kibana\nTrack record of building POCs and carrying research from concept through to a shipped product capability\nExperience leading data requirements work and tying it to cost/benefit analysis on collecting and storing only high-value telemetry\nCommitment to clear written documentation of research findings\nComfortable reading Apple developer documentation, framework headers, and API references to answer undocumented questions\nAn understanding of how SMBs utilize IT automation tools such as PSAs and RMMs is strongly preferred\n Bonus: Comfortable reverse engineering Mach-O binaries and scripted payloads using debuggers and a disassembler suite (Binary Ninja, IDA Pro, Hopper, or Ghidra)\nWhat We Offer: \n100% remote work environment - since our founding in 2015\nGenerous paid time off policy, including vacation, sick time, and paid holidays\n12 weeks of paid parental leave\nHighly competitive and comprehensive medical, dental, and vision benefits plans \n401(k) with a 5% contribution regardless of employee contribution\nLife and Disability insurance plans\nStock options for all full-time employees \nOne-time $500 reimbursement for building/upgrading home office\nAnnual allowance for education and professional development assistance \n$75 USD/month digital reimbursement\nAccess to the BetterUp platform for coaching, personal, and professional growth\n\nHuntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. \nWe do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. \nWe do discriminate against hackers who try to exploit businesses of all sizes.\nAccommodations: \nIf you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to . Please note that non-accommodation requests to this inbox will not receive a response. \nHuntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights.\n#BI-Remote","description_format":"text","description_chars":6399,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Home office","Parental leave","Professional development","Stock options"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Endpoint Security","Security Operations","Managed Security"],"lifecycle":[{"event":"open","at":"2026-10-09T21:30:44Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.843,"p_room":0.75,"age_days":26,"expected_fill_days":30,"reasons":["conf:2","velocity","win:late"],"computed_at":"2026-11-05T05:54:30Z"},"pay":{"stated_usd_annual":215000,"is_top_pay":true},"html_url":"https://alion.io/job/huntress-principal-macos-security-researcher","json_url":"https://alion.io/job/huntress-principal-macos-security-researcher.json","meta":{"generated_at":"2026-11-05T13:27:35Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":17463,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-06T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2007},"rest":"https://alion.io/mcp/rest/get_company?id=2007"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fhuntress-principal-macos-security-researcher"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fhuntress-principal-macos-security-researcher"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fhuntress-principal-macos-security-researcher"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/huntress-principal-macos-security-researcher\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fhuntress-principal-macos-security-researcher"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2201790}},{"tool":"search_jobs","arguments":{"company":"huntress.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2201790},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}