CrowdStrike
Engineer III - MacOS Sensor (Remote)
$120K–$180K
USA - Remote · Full-time · Posted Oct 21, 2026
- Experience
- 3+ years; either reverse engineering, threat detection, and malware analysis with familiarity with on-device development, or software design and delivery with familiarity or proven interest in security.
About the job
Researches macOS threats and develops production endpoint-sensor capabilities to detect malicious activity and prevent breaches.
What you'll do
- Research detection techniques, including reverse engineering or big-data analysis, and design detection logic and systems.
- Own sensor features through design, implementation, release, and post-release support.
- Collaborate across teams and troubleshoot customer-reported product issues.
What they ask for
- 3+ years of experience in either reverse engineering, threat detection, and malware analysis with familiarity with on-device development, or software delivery in Swift, C/C++, or Objective-C with familiarity or proven interest in security.
- Solid knowledge of macOS internals, including processes, storage, networking, and memory management.
- Ability to develop reliable, performant, high-concurrency code in Swift and/or C/C++.
- Experience delivering enterprise software collaboratively, and proven use of AI technologies to enhance decision-making, workflows, efficiency, and business outcomes.
Nice to have
- Familiarity with macOS security frameworks and events, such as Endpoint Security and Network Extension, and recent macOS APIs, SDKs, and OS developments.
- Security experience in endpoint threat detection or sensor development; Python and scripting experience.
Pay
USD $120,000 - $180,000 per year base salary
Tools
macOS, Swift, C++, Python, Objective-C, Endpoint Security, Network Extension, Linux
AI focus
Use AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency, and drive business outcomes; familiarity with AI developments in the macOS threat landscape is a bonus.
Model-written summary · the original posting is authoritative