Security Researcher

Iru

. Own detections end to end: research behavior, write logic, validate it, and ship it into the EDR product .

Posted 11/5/2026full-timeMiami • Florida • United StatesMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in detection engineering and malware analysis, with a strong focus on developing and validating file-based and behavioral detections for Windows and macOS. Proficient in utilizing threat intelligence platforms and communicating research findings effectively.

Highest-signal resume keywords

Detection EngineeringMalware AnalysisYARA DevelopmentMITRE ATT&CK MappingThreat Intelligence Hunting

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Detection Logic DevelopmentBehavioral DetectionMalware Analysis TechniquesPython ProgrammingPowerShell ScriptingBash ScriptingSQL ProficiencyWindows OS InternalsMacOS FamiliarityVulnerability Detection Methods

Soft Skills

Effective CommunicationCollaborationResearch SkillsQuality AssurancePresentation Skills

Tools & Technologies

YARASigmaBinary NinjaGhidraIDAWinDbgSysinternalsVirusTotalGoogle Threat IntelligenceEndpoint Security APIs

Industry Keywords

CybersecurityEndpoint Detection and ResponseMalware ClassificationCVE EcosystemThreat Landscape

Tech Stack

Tools & technologies

Cyber SecurityMacOSPythonSQL

About the role

Key responsibilities & impact

Own detections end to end: research behavior, write logic, validate it, and ship it into the EDR product
Develop and enhance file-based and behavioral detections for Windows and macOS using YARA, Sigma, and proprietary behavioral rule formats
Analyze malware and adversarial behavior across Windows and macOS to identify detection opportunities
Map detection coverage to MITRE ATT&CK and real-world campaigns, identify gaps, and prioritize future work
Test and validate detections against real samples and emulated adversary behavior
Identify required event sources and sensor capabilities from agent telemetry and communicate needs to engineering
Collaborate with engineering teams to incorporate detection logic into the cross-platform security agent
Hunt emerging threats using threat intelligence platforms, retrohunts, livehunts, and hunting rule development
Contribute to the Vulnerability product by triaging CVEs and correcting public vulnerability data, including affected versions, product/vendor naming, and advisory inconsistencies
Research software versioning, naming, and distribution and develop accurate vulnerability detection methods
Build and maintain analysis pipelines, threat monitoring, sample processing, and rule testing automation
Monitor emerging threats and trends across Windows and macOS and provide research-driven product roadmap recommendations
Review teammates’ detection content and raise team quality standards
Author blog posts, present findings at industry conferences, and document research for internal and external audiences

Requirements

What you’ll need

3–5 years of experience in cybersecurity, with a hands-on focus on detection engineering and malware analysis
Depth on Windows; working familiarity with macOS and willingness to build depth there
Proven track record building file-based and behavioral endpoint detections using YARA and Sigma and shipping them into a product or production environment
Experience taking detections from research through testing and release and maintaining them as adversary behavior changes
Strong understanding of Windows and macOS OS internals and endpoint security mechanisms, including ETW, kernel callbacks, and Endpoint Security APIs, and the telemetry they produce
Working knowledge of adversary tradecraft and MITRE ATT&CK
Experience with malware analysis tools and techniques, including Binary Ninja, Ghidra, IDA, WinDbg, Sysinternals, or Mac Monitor
Experience hunting with threat intelligence platforms such as VirusTotal and Google Threat Intelligence, including retrohunting and hunting rule development
Working knowledge of the CVE and vulnerability data ecosystem, including NVD, vendor advisories, CPE, and version matching
Proficiency with Python, PowerShell, Bash, and SQL, and comfort working with large sample sets
Demonstrated ability to communicate research externally through blog posts, conference talks, or published work
Preferred: experience developing or contributing to EDR or next-gen antivirus products
Preferred: experience with detection-as-code practices, AI tools for threat research, machine learning or statistical methods for malware classification, malware detonation or sandboxing, Windows and macOS threat landscapes, and vulnerability prioritization frameworks

Benefits

Comp & perks

Competitive salary
Hybrid work environment (3 days in office per week)
100% individual and dependent medical + dental + vision coverage
401(K) with a 4% company match
20 days PTO
Iru Wellness Week the first week in July
Equity for full-time employees
In-office lunch stipend provided
Up to 16 weeks of paid leave for new parents
Paid Family and Medical Leave
Modern Health mental health benefits for individuals and dependents
Fertility benefits
Working Advantage employee discounts
Onsite fitness center
Free parking
Exciting opportunities for career growth