EDR Evasion Specialist
Posted 14 Oct 2026
BranchFactor Summary
The original posting with the fluff stripped out
- Expected experience
- 5+ yrs
- Management level
- Individual contributor
- Employment
- Hybrid
No salary listed for this role.
🔹 Title: EDR Evasion Specialist
📍 Locations (Hybrid): Tel Aviv, Israel
👥 Reporting To: Attack Team Leader
🌟 **Opportunity Highlights
**
We are looking for an EDR Evasion Specialist to join SafeBreach's offensive attack team. You will be the company's deepest expert on how modern endpoint security products detect and block adversary activity, and on how real attackers get around them. Your work turns that expertise into safe, production-grade attack content that lets enterprises continuously validate that their endpoint controls stop today's threats. This is a hands-on development role at the heart of what SafeBreach ships to every customer.
🚀 **The Impact You Will Have
**
- Own the endpoint evasion research and development domain: track how leading EDR, XDR, and AV products detect attacker behavior, and keep the SafeBreach attack library ahead of them
- Research, prototype, and productize evasion techniques observed from real threat actors across Windows, Linux, and macOS, delivered as safe, reversible, and measurable simulations
- Build and maintain stealthy, stable attack components with a strong emphasis on operational safety in customer environments
- Partner with other Attack developers and platform engineering teams to integrate into the SafeBreach simulator and post-breach propagation engine
- Harness AI coding agents to accelerate research, tooling, and content delivery
**🧬 What Sets You Apart
**
-
5+ years of hands-on offensive security work, with at least 3 years focused on endpoint defense evasion
-
Expert-level understanding of OS internals and the mechanisms security products rely on for visibility
-
Deep, practical knowledge of how commercial EDR products work, what they see, and where their coverage ends
-
Strong C/C++ and Python skills; comfort with assembly and reverse engineering tools (IDA, Ghidra, WinDbg)
**💥 Even BETTER if you have
**
-
Background in red teaming, adversary emulation, or APT simulation against mature, well-defended environments
-
Experience on the defensive side: building detections, working at an EDR vendor, or tuning endpoint products
-
Experience with MITRE ATT&CK and implementing or simulating ATT&CK techniques
-
Understanding of modern threat actor TTPs and practical application in research environments