EDR Evasion Specialist

The role

You will own the endpoint evasion research and development domain by tracking how EDR, XDR, and AV products detect attacker behavior. You will research, prototype, and productize evasion techniques across Windows, Linux, and macOS as safe simulations.

What you will do

• Own the endpoint evasion research and development domain
• Track how leading EDR, XDR, and AV products detect attacker behavior
• Research, prototype, and productize evasion techniques observed from real threat actors
• Build and maintain stealthy, stable attack components
• Partner with other Attack developers and platform engineering teams
• Harness AI coding agents to accelerate research, tooling, and content delivery

Required qualifications

• 5+ years of hands-on offensive security work
• At least 3 years focused on endpoint defense evasion
• Expert-level understanding of OS internals and the mechanisms security products rely on for visibility
• Deep, practical knowledge of how commercial EDR products work
• Strong C/C++ and Python skills
• Comfort with assembly and reverse engineering tools (IDA, Ghidra, WinDbg)

Nice to have

• Background in red teaming, adversary emulation, or APT simulation against mature, well-defended environments
• Experience on the defensive side: building detections, working at an EDR vendor, or tuning endpoint products
• Experience with MITRE ATT&CK and implementing or simulating ATT&CK techniques
• Understanding of modern threat actor TTPs and practical application in research environments

Benefits

• Competitive salary and equity grants
• Hybrid flexibility
• Quarterly recharge weekends
• Learning & development stipend
• Generous paid leave policies including flexible PTO and parental leave

Before you apply

• Complete an assignment to understand real scenarios
• Connect with Dev team to discuss assignment
• Meet the team at the office

About the company

SafeBreach is a global leader in adversarial exposure validation (AEV) that empowers organizations to take command of risk with the SafeBreach CTEM Platform. The company is a team of passionate security professionals and innovators.