What We Do:
Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact.
Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection.
Huntress now secures more than 5M endpoints and 16M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other.
Reports to: Manager, Product Research
Location: Remote US
Compensation Range: $215,000.00 to $225,000.00 base plus bonus and equity
What You’ll Do:
- Lead product research initiatives that develop and evaluate macOS security product strategies and technologies
- Identify and prototype new telemetry from Apple's Endpoint Security API and other macOS subsystems to expand prevention, hardening, and detection capabilities
- Reproduce and analyze macOS attacks through hands-on execution of attacker techniques, malware detonation, and vulnerability exploitation
- Reverse engineer macOS malware and Apple's own security frameworks (XProtect, XProtect Remediator, Gatekeeper, TCC) to identify coverage gaps and inform product direction
- Prototype and test new tools and methodologies for offensive operations against macOS endpoints, including EDR evasion and bypass research
- Build proof-of-concept implementations that demonstrate the feasibility of new capabilities
- Document research findings and collaborate with Detection Engineering on writing and tuning detectors
- Coordinate with Product and Engineering teams to integrate and operationalize solutions developed by Security teams
- Stand up ephemeral research environments and attacker infrastructure using cloud, VM, and container technologies
- Track Apple platform changes across beta and release cycles, and assess their impact on agent capability, telemetry, and detection coverage
- Identify and address gaps in macOS product coverage, including false positive and false negative investigations
- Develop internal and external technical documentation to educate customers and adjacent teams on macOS security risks and opportunities
- Mentor and teach across the team on macOS internals, malware analysis, and research methodology
- Promote Huntress' reputation through public speaking, CFPs, blogs, and media interaction
What You Bring To The Team:
- Deep expertise in macOS system internals, including the security model, code signing and notarization, TCC, SIP, persistence, and the Mach-O file format
- Hands-on experience with Apple's Endpoint Security API and system extension development
- Authority on macOS security threats, attack techniques, and the current macOS malware landscape
- Familiarity with macOS fleet management (MDM, configuration profiles, mobileconfig deployment)
- Experience red teaming and performing attack emulation to bypass EDR on macOS
- Proficiency with Swift. Additional understanding of Go, Python, and/or Ruby is preferred.
- Experience with the MITRE ATT&CK matrix, Sigma, YARA, and Elasticsearch/Kibana
- Track record of building POCs and carrying research from concept through to a shipped product capability
- Experience leading data requirements work and tying it to cost/benefit analysis on collecting and storing only high-value telemetry
- Commitment to clear written documentation of research findings
- Comfortable reading Apple developer documentation, framework headers, and API references to answer undocumented questions
- An understanding of how SMBs utilize IT automation tools such as PSAs and RMMs is strongly preferred
- Bonus: Comfortable reverse engineering Mach-O binaries and scripted payloads using debuggers and a disassembler suite (Binary Ninja, IDA Pro, Hopper, or Ghidra)
What We Offer:
- 100% remote work environment - since our founding in 2015
- Generous paid time off policy, including vacation, sick time, and paid holidays
- 12 weeks of paid parental leave
- Highly competitive and comprehensive medical, dental, and vision benefits plans
- 401(k) with a 5% contribution regardless of employee contribution
- Life and Disability insurance plans
- Stock options for all full-time employees
- One-time $500 reimbursement for building/upgrading home office
- Annual allowance for education and professional development assistance
- $75 USD/month digital reimbursement
- Access to the BetterUp platform for coaching, personal, and professional growth
Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are.
We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status.
We do discriminate against hackers who try to exploit businesses of all sizes.
Accommodations:
If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to [email protected]. Please note that non-accommodation requests to this inbox will not receive a response.
Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights.
#BI-Remote
Skills Required
- Deep expertise in macOS system internals, including security model, code signing, notarization, TCC, SIP, persistence, and Mach-O
- Hands-on experience with Apple's Endpoint Security API and system extension development
- Expertise in macOS security threats, attack techniques, and the current macOS malware landscape
- Familiarity with macOS fleet management, MDM, configuration profiles, and mobileconfig deployment
- Experience with red teaming and attack emulation to bypass EDR on macOS
- Proficiency with Swift
- Understanding of Go, Python, and/or Ruby
- Experience with MITRE ATT&CK, Sigma, YARA, and Elasticsearch/Kibana
- Track record of building proof-of-concept implementations and taking research through shipped product capabilities
- Experience leading data requirements work and evaluating telemetry collection and storage cost-benefit
- Clear written documentation of research findings
- Ability to read Apple developer documentation, framework headers, and API references
- Understanding of SMB IT automation tools such as PSAs and RMMs
- Reverse engineering Mach-O binaries and scripted payloads with debuggers and a disassembler suite
Huntress Compensation & Benefits Highlights
-
Retirement Support — A 5% employer 401(k) contribution is provided even when employees contribute nothing themselves, and this non‑elective support is repeatedly emphasized as a standout element. This materially strengthens total compensation for many U.S. employees.
-
Healthcare Strength — The package includes comprehensive medical, dental, and vision coverage alongside life/disability and pet insurance, with multiple descriptions noting strong satisfaction and low employee costs. Health benefits are highlighted across company and third‑party materials as a core strength.
-
Parental & Family Support — Twelve weeks of paid parental leave are consistently stated for new parents, paired with vacation, sick time, bereavement leave, and floating holidays. This breadth of family support is positioned as a key component of the overall package.
Huntress Insights
What We Do
Founded in 2015 by former NSA cyber operators, Huntress protects all businesses—not just the 1%—with enterprise-grade, fully owned and managed cybersecurity products at the price of an affordable SaaS application. The Huntress difference is our One Team advantage: our technology is designed with our industry-defining Security Operations Center (SOC) in mind and is never separated from our service. We protect 4M+ endpoints and 7M+ identities worldwide, elevating underresourced IT teams with protection that works as hard as they do. As long as hackers keep hacking, Huntress keeps hunting.
Why Work With Us
Huntress is a fully remote, global team of passionate experts and ethical badasses on a mission to break down the barriers to cybersecurity. Whether creating purpose-built security solutions, hunting down hackers, or impacting our community, our people go above and beyond to change the security game and make a real difference.
Gallery
.jpg)
.jpg)
Huntress Teams
Huntress Offices
Remote Workspace
Employees work remotely.
We believe in hiring the best people regardless of location or time zone. We currently hire individuals in the US, Canada, the UK, Ireland, and Australia.
