Security Researcher

About Iru

Iru is the AI-powered security & IT platform used by the world’s fastest-growing companies to secure their users, apps, and devices. Built for the AI era, Iru unifies identity & access, endpoint security & management, and compliance automation—collapsing the stack and giving IT & security time and control back.

Iru is backed by some of the smartest investors in tech—General Catalyst, Tiger Global, Felicis, Greycroft, and First Round Capital. In July 2024, Iru raised $100 million from General Catalyst, valuing the company at $850 million. Customers include Cursor, Vercel, Bumble, Plaid, Glean, Apollo, Replit, and Mercor, and Iru partners with industry leaders such as ServiceNow and AWS. Iru was named to Forbes’ America’s Best Startup Employers 2025 list for employee engagement and satisfaction.

Key Responsibilities - Own detections end to end: research the behavior, write the logic, validate it, and ship it into our EDR product.

- Develop and enhance file-based and behavioral detections for Windows and macOS (YARA, Sigma, and our own behavioral rule formats).

- Perform in-depth analysis of malware and adversarial behavior across both platforms to identify detection opportunities.

- Map detection coverage against adversary tradecraft (MITRE ATT&CK and real-world campaigns), find the gaps, and prioritize what to build next.

- Test and validate detections against real samples and emulated adversary behavior before they reach customers.

- Work with the telemetry our agent collects, and tell engineering when it isn’t enough: identify the event sources and sensor capabilities needed to detect what you’re seeing.

- Collaborate with engineering teams to incorporate detection logic into our cross-platform security agent.

- Hunt for new and emerging threats using threat intelligence platforms (retrohunts, livehunts, and hunting rule development), and turn what you find into shipped coverage.

- Contribute to our Vulnerability product as an intelligence researcher: triage newly disclosed CVEs, then enrich and correct the public data behind them (affected version ranges, product and vendor naming, advisory gaps and inconsistencies) so that what we report as vulnerable reflects reality.

- Research how vendors version, name, and distribute their software, and develop vulnerability detection methods that match accurately against real-world software inventories.

- Build and maintain the tooling and automation your work depends on: analysis pipelines, threat monitoring, sample processing, and rule testing workflows.

- Continuously monitor emerging threats and trends across Windows and macOS ecosystems, and surface research-driven recommendations into the product roadmap.

- Review teammates’ detection content and help raise the quality bar across the team.

- Author blog posts and present findings at industry conferences, and document research clearly for both internal and external audiences.

Qualifications - 3–5 years of experience in cybersecurity, with a hands-on focus on detection engineering and malware analysis. Depth on Windows is what the team most needs today; working familiarity with macOS and a willingness to build depth there is expected.

- Proven track record building file-based and behavioral detections for endpoints (YARA, Sigma) and shipping them into a product or production environment.

- Experience taking a detection from research through testing and release, and maintaining it over time as adversary behavior changes.

- Strong understanding of OS internals and endpoint security mechanisms on Windows and macOS (ETW and kernel callbacks, Endpoint Security APIs), and of the telemetry they produce.

- Working knowledge of adversary tradecraft and detection coverage frameworks (MITRE ATT&CK).

- Experience with malware analysis tools and techniques (Binary Ninja, Ghidra, IDA, WinDbg, Sysinternals, or Mac Monitor).

- Experience hunting with threat intelligence platforms (VirusTotal, Google Threat Intel