Security Researcher

About the role

About Iru

Iru is the AI-powered security & IT platform used by the world’s fastest-growing companies to secure their users, apps, and devices. Built for the AI era, Iru unifies identity & access, endpoint security & management, and compliance automation—collapsing the stack and giving IT & security time and control back.

Iru is backed by some of the smartest investors in tech—General Catalyst, Tiger Global, Felicis, Greycroft, and First Round Capital. In July 2024, Iru raised $100 million from General Catalyst, valuing the company at $850 million. Customers include Cursor, Vercel, Bumble, Plaid, Glean, Apollo, Replit, and Mercor, and Iru partners with industry leaders such as ServiceNow and AWS. Iru was named to Forbes’ America’s Best Startup Employers 2025 list for employee engagement and satisfaction.

Role Overview

We are looking for a Security Researcher focused on detection engineering for Windows and macOS to join our small, focused Threat Intelligence and Research team. You’ll own detections end to end: researching adversary behavior, turning that research into file-based and behavioral detection logic, validating it, and shipping it into our EDR product.

Detection engineering is the core of the role, and the research that feeds it is yours to drive: reverse engineering malware, hunting for emerging threats, and finding where our coverage falls short. You’ll also contribute to our Vulnerability product, where the work is intelligence rather than discovery. You’ll research how vendors version and distribute their software, correct the gaps and errors in public vulnerability data, and make sure what we report as vulnerable matches what customers actually have installed.

You’ll build the tooling your detection work depends on, and help raise the team’s external profile through published research and conference talks. As part of a small team, you’ll have significant ownership over your work and a direct impact on the direction of our research and products.

Key Responsibilities - Own detections end to end: research the behavior, write the logic, validate it, and ship it into our EDR product.

- Develop and enhance file-based and behavioral detections for Windows and macOS (YARA, Sigma, and our own behavioral rule formats).

- Perform in-depth analysis of malware and adversarial behavior across both platforms to identify detection opportunities.

- Map detection coverage against adversary tradecraft (MITRE ATT&CK and real-world campaigns), find the gaps, and prioritize what to build next.

- Test and validate detections against real samples and emulated adversary behavior before they reach customers.

- Work with the telemetry our agent collects, and tell engineering when it isn’t enough: identify the event sources and sensor capabilities needed to detect what you’re seeing.

- Collaborate with engineering teams to incorporate detection logic into our cross-platform security agent.