EDR Evasion Specialist

SafeBreach

Israel

Hybrid

Who this role is best for

A natural match if you have hands-on offensive security experience focused on endpoint evasion and strong programming skills.

Best fit for

Candidates with offensive security experience in endpoint evasion and a background in red teaming or APT simulation
— “Background in red teaming, adversary emulation, or APT simulation against mature, well-defended environments”
Individuals with practical knowledge of commercial EDR products and their detection limitations
— “Deep, practical knowledge of how commercial EDR products work, what they see, and where their coverage ends”
Professionals skilled in C/C++ and Python, with comfort in reverse engineering tools
— “Strong C/C++ and Python skills; comfort with assembly and reverse engineering tools (IDA, Ghidra, WinDbg)”

Things to consider

The role involves significant collaboration with platform engineering and attack developers
— “Partner with other Attack developers and platform engineering teams to integrate into the SafeBreach simulator”

How to stand out

Emphasize your hands-on research and development of evasion techniques across multiple OS platforms
— “Research, prototype, and productize evasion techniques observed from real threat actors across Windows, Linux, and macOS”
Showcase your ability to create production-grade attack content that is safe and reversible
— “Delivered as safe, reversible, and measurable simulations”
Highlight your experience with MITRE ATT&CK and how you've applied it in simulation or research
— “Experience with MITRE ATT&CK and implementing or simulating ATT&CK techniques”
Demonstrate your ability to work with AI coding agents to accelerate content delivery
— “Harness AI coding agents to accelerate research, tooling, and content delivery”

Pace · Fast PacedCollaboration · MediumAutonomy · HighDecision Impact · Team

Derived from job-description analysis by Serendipath's career intelligence engine.

What success looks like

research and prototype evasion techniques
build and maintain stealthy attack components
integrate into the SafeBreach simulator

Typical background

offensive securityendpoint defense evasion

Skills & requirements

Required

Offensive SecurityEndpoint EvasionC/c++PythonAssemblyReverse EngineeringMitre Att&ck

Preferred

Red TeamingAdversary EmulationAPT SimulationEDR ProductsKubernetes

Stack & domain

EDRXDRAVC/c++PythonAssemblyReverse EngineeringMitre Att&ckAI Coding AgentsOffensive SecurityRed TeamingAdversary EmulationAPT SimulationUnderstanding Of Modern Threat Actor TtpsEndpoint SecurityCybersecurity

About the role

Original posting from SafeBreach via Greenhouse

🔹 Title: EDR Evasion Specialist
📍 Locations (Hybrid): Tel Aviv, Israel
👥 Reporting To: Attack Team Leader
🌟 Opportunity Highlights
We are looking for an EDR Evasion Specialist to join SafeBreach's offensive attack team. You will be the company's deepest expert on how modern endpoint security products detect and block adversary activity, and on how real attackers get around them. Your work turns that expertise into safe, production-grade attack content that lets enterprises continuously validate that their endpoint controls stop today's threats. This is a hands-on development role at the heart of what SafeBreach ships to every customer.
🚀 The Impact You Will Have
Own the endpoint evasion research and development domain: track how leading EDR, XDR, and AV products detect attacker behavior, and keep the SafeBreach attack library ahead of them
Research, prototype, and productize evasion techniques observed from real threat actors across Windows, Linux, and macOS, delivered as safe, reversible, and measurable simulations
Build and maintain stealthy, stable attack components with a strong emphasis on operational safety in customer environments
Partner with other Attack developers and platform engineering teams to integrate into the SafeBreach simulator and post-breach propagation engine
Harness AI coding agents to accelerate research, tooling, and content delivery
🧬 What Sets You Apart
5+ years of hands-on offensive security work, with at least 3 years focused on endpoint defense evasion
Expert-level understanding of OS internals and the mechanisms security products rely on for visibility
Deep, practical knowledge of how commercial EDR products work, what they see, and where their coverage ends
Strong C/C++ and Python skills; comfort with assembly and reverse engineering tools (IDA, Ghidra, WinDbg)
💥 Even BETTER if you have
Background in red teaming, adversary emulation, or APT simulation against mature, well-defended environments
Experience on the defensive side: building detections, working at an EDR vendor, or tuning endpoint products
Experience with MITRE ATT&CK and implementing or simulating ATT&CK techniques
Understanding of modern threat actor TTPs and practical application in research environments
👋 Who We Are
SafeBreach is on a mission to help organizations have certainty in their security. Long trusted as the global leader in adversarial exposure validation (AEV), SafeBreach empowers organizations to take command of risk by operationalizing the full CTEM lifecycle with the SafeBreach CTEM Platform. Powered by the SafeBreach Helm AI infrastructure layer and grounded in the award-winning SafeBreach Exposure Validation Platform, the SafeBreach CTEM Platform is the first enterprise-grade, closed-loop solution designed to move organizations beyond siloed security activities toward a continuous, intelligence-driven exposure management program. Backed by world-renowned threat researchers and an unrivaled customer success team, SafeBreach provides the capabilities enterprises need to holistically understand threat exposure, make data-driven decisions that reduce risk, and measurably improve cyber resilience—safely and at scale. We are a team of passionate security professionals and innovators. If you’re ready to tackle complex security challenges and make a tangible impact on enterprise defense, we’d love to meet you.
💰 What We Offer
Competitive salary and equity grants
Hybrid flexibility
Quarterly recharge weekends
Learning & development stipend
Generous paid leave policies including flexible PTO and parental leave
🤝 HOW WE'LL GET TO KNOW EACH OTHER
We view interviewing as a two-way street. We want you to interview us just as much as we interview you! (Avg. timeline: 21-28 days)
Step 1: The Intro (15 min)
A casual meeting with the Talent team to break the ice.
Step 2: The Technical Aspects (3-4 days. + 60 min meeting)
Complete an assignment to understand real scenarios you will face in this role, then connect with our Dev team to discuss it.
Step 3: The Vision & The Big Picture (45-60 min meetings)
Meet the team at the office. Connect your future manager to discuss the role, the challenges, and how you can make an impact. Also meet with our HR Team and VP of R&D to ensure our values and long-term goals align with yours.
Step 4: The Offer
If the vibe is right, we make it official!
🌍 DEI&B Commitment (Diversity, Equity, Inclusion & Belonging)
At SafeBreach, we celebrate the rich diversity of our team, where every employee's unique perspective is a valued thread in our collective success. We are unwavering in our commitment to fostering an inclusive workplace that nurtures a sense of belonging and empowers each individual to unleash their full potential. We are dedicated to creating opportunities for collaboration, innovation, and meaningful career growth, ensuring that every voice is not just heard, but cherished.

Source: SafeBreach careers (Greenhouse)