EDR Evasion Specialist
Join SafeBreach as an EDR Evasion Specialist to lead endpoint evasion research and development for enterprise security validation.
Posted by employer 3 days ago
First seen on Joblaze 2 days ago
Last verified on the company career page 22 hours ago
What you'll build
- Own the endpoint evasion research and development domain
- Research, prototype, and productize evasion techniques
- Build and maintain stealthy, stable attack components
- Partner with other Attack developers and platform engineering teams
- Integrate into the SafeBreach simulator and post-breach propagation engine
Must have
- 5+ years of hands-on offensive security work
- 3 years focused on endpoint defense evasion
- Expert-level understanding of OS internals
- Deep knowledge of commercial EDR products
- Strong C/C++ and Python skills
Nice to have
- Background in red teaming or adversary emulation
- Experience on the defensive side
- Experience with MITRE ATT&CK
- Understanding of modern threat actor TTPs
AI in the day-to-day
Harness AI coding agents to accelerate research, tooling, and content delivery.
Requirements
- Experience
- 5+ years
Not disclosed in this posting: compensation, visa sponsorship.
Benefits
Joblaze summary
The EDR Evasion Specialist at SafeBreach focuses on researching and developing techniques to bypass modern endpoint security systems, ensuring that the company's attack simulations remain effective against evolving threats. This role requires deep expertise in operating systems, security product mechanisms, and programming skills in C/C++ and Python, along with a solid understanding of threat actor behaviors. Ideal candidates will have significant experience in offensive security, particularly in endpoint defense evasion, and may come from backgrounds in red teaming or adversary emulation. SafeBreach emphasizes a collaborative environment, integrating efforts across teams to enhance their se
Joblaze insights
- Listed 2 days ago — first seen on Joblaze October 15, 2026. Last confirmed on SafeBreach's careers page October 17, 2026.
Quick facts
- Is the EDR Evasion Specialist role remote?
- It's hybrid — SafeBreach expects some on-site time in Tel Aviv, Israel.
- How much experience is required?
- At least 5 years of relevant experience for this EDR Evasion Specialist role.
- Where is the role based?
- SafeBreach is hiring for this position in Tel Aviv, Israel.
- What's the tech stack?
- Joblaze extracted these technologies from the posting: AI, C++, Linux, Python, Windows, macOS.
- What seniority level is this role?
- SafeBreach targets senior candidates for this position.
- Is this full-time or contract?
- Full-time for this EDR Evasion Specialist role at SafeBreach.
From the original posting
🔹 Title: EDR Evasion Specialist
📍 Locations (Hybrid): Tel Aviv, Israel
👥 Reporting To: Attack Team Leader
🌟 Opportunity Highlights
We are looking for an EDR Evasion Specialist to join SafeBreach's offensive attack team. You will be the company's deepest expert on how modern endpoint security products detect and block adversary activity, and on how real attackers get around them. Your work turns that expertise into safe, production-grade attack content that lets enterprises continuously validate that their endpoint controls stop today's threats. This is a hands-on development role at the heart of what SafeBreach ships to every customer.
🚀 The Impact You Will Have
- Own the endpoint evasion research and development domain: track how leading EDR, XDR, and AV products detect attacker behavior, and keep the SafeBreach attack library ahead of them
- Research, prototype, and productize evasion techniques observed from real threat actors across Windows, Linux, and macOS, delivered as safe, reversible, and measurable simulations
- Build and maintain stealthy, stable attack components with a strong emphasis on operational safety in customer environments
- Partner with other Attack developers and platform engineering teams to integrate into the SafeBreach simulator and post-breach propagation engine
- Harness AI coding agents to accelerate research, tooling, and content delivery
🧬 What Sets You Apart
-
5+ years of hands-on offensive security work, with at least 3 years focused on endpoint defense evasion
-
Expert-level understanding of OS internals and the mechanisms security products rely on for visibility
-
Deep, practical knowledge of how commercial EDR products work, what they see, and where their coverage ends
-
Strong C/C++ and Python skills; comfort with assembly and reverse engineering tools (IDA, Ghidra, WinDbg)
💥 Even BETTER if you have
-
Background in red teaming, adversary emulation, or APT simulation against mature, well-defended environments
-
Experience on the defensive side: building detections, working at an EDR vendor, or tuning endpoint products
-
Experience with MITRE ATT&CK and implementing or simulating ATT&CK techniques
-
Understanding of modern threat actor TTPs and practical application in research environments
👋 Who We Are
💰 What We Offer
- Competitive salary and equity grants
- Hybrid flexibility
- Quarterly recharge weekends
- Learning & development stipend
- Generous paid leave policies including flexible PTO and parental leave
We view interviewing as a two-way street. We want you to interview us just as much as we interview you! (Avg. timeline: 21-28 days)
Step 2: The Technical Aspects (3-4 days. + 60 min meeting)
Complete an assignment to understand real scenarios you will face in this role, then connect with our Dev team to discuss it.
Step 3: The Vision & The Big Picture (45-60 min meetings)
Meet the team at the office. Connect your future manager to discuss the role, the challenges, and how you can make an impact. Also meet with our HR Team and VP of R&D to ensure our values and long-term goals align with yours.
🌍 DEI&B Commitment (Diversity, Equity, Inclusion & Belonging)
Standard company text repeated across SafeBreach's postings is omitted here.