Malware Research Engineer - Mac

About the Role

We're looking for a Mac Malware Researcher who will own end-to-end analysis of sophisticated macOS threats—from reverse engineering Mach-O binaries to developing detection strategies that ship directly into our security products. You'll sit at the intersection of threat research and engineering, collaborating closely with detection and product teams to harden coverage for 25 million+ users. This role is open as we accelerate our macOS security capabilities and need a technically sharp researcher who can both dig deep into malware internals and surface findings externally through blogs, whitepapers, and industry conferences.

What You'll Do

• Reverse engineer Mach-O binaries, malicious installers (PKG, DMG), and scripts to identify spyware, backdoors, loaders, and adware behaviors
• Develop and maintain detection signatures, behavioral rules, YARA rules, and generic/heuristic signatures to deliver rapid, scalable protection
• Research macOS-specific persistence mechanisms—LaunchAgents, LaunchDaemons, cron jobs, login items—and study evasion techniques including notarization abuse, code signing misuse, and sandbox bypass attempts
• Conduct advanced static and dynamic analysis, memory forensics, and behavioral analysis to track malware families, variants, and evolving attack techniques including zero-days
• Write technical reports and threat intelligence documentation, and advocate for research findings through internal stakeholder briefings, external blogs, whitepapers, and industry conferences
• Partner with detection engineering and product teams to translate research insights into measurable improvements in macOS security coverage

What We're Looking For

• 3–5 years of hands-on Mac malware analysis experience with demonstrated proficiency in reverse engineering tools including Hopper, IDA Pro, Ghidra, and LLDB
• Deep knowledge of macOS internals and security architecture—Gatekeeper, XProtect, SIP, TCC—and the Mach-O file format and DYLD dynamic library loading
• Proficiency in C, C++, Objective-C, and Swift, with working knowledge of shell scripting (bash, zsh) and Python
• Proven experience creating YARA rules and generic/heuristic signatures with measurable detection outcomes
• Strong understanding of networking, C2 communication patterns, and persistence techniques specific to macOS