{"id":3821603,"url":"https://alion.io/job/iru-security-researcher","title":"Security Researcher","company":{"id":15685,"name":"Iru","domain":"iru.com","url":"https://alion.io/company/iru","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"A","score":86,"open_postings":17,"ghost_share":0,"stale_share":0.353,"repost_share":0,"time_to_fill_p50_days":60,"computed_at":"2026-11-07T05:47:08Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Miami, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Binary Ninja","optional":false},{"name":"CVE","optional":false},{"name":"Ghidra","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SQL","optional":false},{"name":"VirusTotal","optional":false},{"name":"WinDbg","optional":false},{"name":"Windows","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false},{"name":"Assembly","optional":true},{"name":"Machine Learning","optional":true}],"status":"live","first_seen_at":"2026-11-05T17:04:38Z","employer_posted_date":"2026-11-05","last_verified_at":"2026-11-07T09:29:56Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Role Overview\nWe are looking for a Security Researcher focused on detection engineering for Windows and macOS to join our small, focused Threat Intelligence and Research team. You’ll own detections end to end: researching adversary behavior, turning that research into file-based and behavioral detection logic, validating it, and shipping it into our EDR product.\nDetection engineering is the core of the role, and the research that feeds it is yours to drive: reverse engineering malware, hunting for emerging threats, and finding where our coverage falls short. You’ll also contribute to our Vulnerability product, where the work is intelligence rather than discovery. You’ll research how vendors version and distribute their software, correct the gaps and errors in public vulnerability data, and make sure what we report as vulnerable matches what customers actually have installed.\nYou’ll build the tooling your detection work depends on, and help raise the team’s external profile through published research and conference talks. As part of a small team, you’ll have significant ownership over your work and a direct impact on the direction of our research and products.\nKey Responsibilities\nOwn detections end to end: research the behavior, write the logic, validate it, and ship it into our EDR product.\nDevelop and enhance file-based and behavioral detections for Windows and macOS (YARA, Sigma, and our own behavioral rule formats).\nPerform in-depth analysis of malware and adversarial behavior across both platforms to identify detection opportunities.\nMap detection coverage against adversary tradecraft (MITRE ATT&CK and real-world campaigns), find the gaps, and prioritize what to build next.\nTest and validate detections against real samples and emulated adversary behavior before they reach customers.\nWork with the telemetry our agent collects, and tell engineering when it isn’t enough: identify the event sources and sensor capabilities needed to detect what you’re seeing.\nCollaborate with engineering teams to incorporate detection logic into our cross-platform security agent.\nHunt for new and emerging threats using threat intelligence platforms (retrohunts, livehunts, and hunting rule development), and turn what you find into shipped coverage.\nContribute to our Vulnerability product as an intelligence researcher: triage newly disclosed CVEs, then enrich and correct the public data behind them (affected version ranges, product and vendor naming, advisory gaps and inconsistencies) so that what we report as vulnerable reflects reality.\nResearch how vendors version, name, and distribute their software, and develop vulnerability detection methods that match accurately against real-world software inventories.\nBuild and maintain the tooling and automation your work depends on: analysis pipelines, threat monitoring, sample processing, and rule testing workflows.\nContinuously monitor emerging threats and trends across Windows and macOS ecosystems, and surface research-driven recommendations into the product roadmap.\nReview teammates’ detection content and help raise the quality bar across the team.\nAuthor blog posts and present findings at industry conferences, and document research clearly for both internal and external audiences.\nQualifications\n3-5 years of experience in cybersecurity, with a hands-on focus on detection engineering and malware analysis. Depth on Windows is what the team most needs today; working familiarity with macOS and a willingness to build depth there is expected.\nProven track record building file-based and behavioral detections for endpoints (YARA, Sigma) and shipping them into a product or production environment.\nExperience taking a detection from research through testing and release, and maintaining it over time as adversary behavior changes.\nStrong understanding of OS internals and endpoint security mechanisms on Windows and macOS (ETW and kernel callbacks, Endpoint Security APIs), and of the telemetry they produce.\nWorking knowledge of adversary tradecraft and detection coverage frameworks (MITRE ATT&CK).\nExperience with malware analysis tools and techniques (Binary Ninja, Ghidra, IDA, WinDbg, Sysinternals, or Mac Monitor).\nExperience hunting with threat intelligence platforms (VirusTotal, Google Threat Intelligence, or equivalent), including retrohunting and hunting rule development.\nWorking knowledge of the CVE and vulnerability data ecosystem (NVD, vendor advisories, CPE and version matching), and a critical eye for where that data is incomplete, ambiguous, or simply wrong.\nProficiency with security-focused scripting and data analysis (Python, PowerShell, Bash, SQL), and comfort working with large sample sets.\nDemonstrated ability to communicate research externally through blog posts, conference talks, or published work.\nPreferred Qualifications\nExperience developing or contributing to EDR or next-gen antivirus products.\nExperience with detection-as-code practices: version-controlled rules, peer review, and automated rule testing.\nExperience leveraging AI tools to accelerate threat research, detection development, and analysis workflows.\nExperience applying machine learning or statistical methods to malware classification, including building and evaluating against labeled sample corpora.\nExperience with malware detonation environments, sandboxing, or automated dynamic analysis.\nFamiliarity with both Windows and macOS threat landscapes and platform-specific attack techniques.\nDemonstrated ability to assess and prioritize vulnerabilities using industry-standard frameworks and data sources (severity scoring, exploit prediction, known-exploited catalogs).","description_format":"text","description_chars":5667,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Identity Management","IT Service & Asset Management","Endpoint Security","Security Compliance"],"lifecycle":[{"event":"open","at":"2026-11-05T17:28:07Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 5","filings_12m":5,"filings_prev_12m":4,"green_card_filings_12m":0,"median_offered_wage_usd":147500,"route":null,"cap_exempt":false,"checked_at":"2026-11-07T07:57:00+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":1}],"liveness":{"score":99,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.993,"p_room":1,"age_days":1,"expected_fill_days":60,"reasons":["conf:0","urgency","velocity","win:early"],"computed_at":"2026-11-07T05:47:08Z"},"pay":null,"html_url":"https://alion.io/job/iru-security-researcher","json_url":"https://alion.io/job/iru-security-researcher.json","meta":{"generated_at":"2026-11-07T12:47:58Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14732,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-08T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":15685},"rest":"https://alion.io/mcp/rest/get_company?id=15685"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Firu-security-researcher"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Firu-security-researcher"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Firu-security-researcher"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/iru-security-researcher\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Firu-security-researcher"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3821603}},{"tool":"search_jobs","arguments":{"company":"iru.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3821603},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}