iOS User Space Sandbox Escape - Vulnerability Researcher

We are looking for a deeply experienced iOS userspace researcher who has already delivered sandbox escapes, privileged-daemon vulnerabilities or equivalent exploit components.

The work is focused on real trust boundaries exposed through Mach, XPC, private frameworks, privileged services and entitlement-gated functionality. This is not an application-security or jailbreak-usage role.

What you’ll work on

- Privileged iOS daemons, frameworks and services reachable from sandboxed application or browser contexts.

- Mach, XPC, NSXPC, serialisation and object-bridging boundaries.

- Memory corruption, logic vulnerabilities, confused-deputy conditions, race conditions and entitlement bypasses.

- Sandbox profiles, service registration, entitlement checks and cross-process trust relationships.

- Private-framework and daemon-protocol reverse engineering across iOS releases and arm64e devices.

- Exploit-chain integration with browser and kernel researchers when required.

What you’ll deliver

- Original iOS userspace vulnerabilities that cross sandbox, entitlement, process or service boundaries.

- Reliable sandbox-escape exploit components suitable for integration into broader chains.

- Prioritised attack-surface maps for privileged services, framework brokers and entitlement-gated functionality.

- Triggers, PoCs, exploitation strategy, affected-version notes, assumptions and clear technical handover.

- Reusable tooling for service discovery, message generation, daemon instrumentation, entitlement analysis and variant research.

What we’re looking for

- Proven delivery of iOS sandbox escapes, privileged-daemon vulnerabilities or comparable userspace exploit components.

- Deep knowledge of iOS process isolation, code signing, entitlements, sandbox profiles and launch/service models.

- Strong reverse engineering across Objective-C, Swift and C/C++, including private frameworks and stripped binaries.

- Practical expertise with Mach messaging, XPC/NSXPC, serialisation formats and asynchronous service interactions.

- Advanced ARM64/arm64e userspace exploitation, including modern heap behaviour, PAC-aware strategies and constrained code execution.

- The ability to reason about chainability, target variation and reliability rather than stopping at a one-time daemon crash.

- A consistent history of independently finishing complex research.

Strong signals

- Public iOS security credits, jailbreak-chain research or comparable exploit-chain delivery.

- Experience chaining browser compromise into an iOS userspace sandbox escape.

- Custom XPC/Mach fuzzing, service-introspection or firmware-analysis tooling.

- Research across multiple major iOS generations and arm64e hardware families.

- Strong patch-diffing and variant-hunting results.

How we work

- Fully remote, with high autonomy and direct collaboration with browser and kernel specialists.

- We value technically meaningful delivery, clean handover and reproducibility over activity metrics or polished theatre.

- Public CVEs are useful but not required.