iOS User Space Sandbox Escape - Vulnerability Researcher

We are looking for a deeply experienced iOS userspace researcher who has already delivered sandbox escapes, privileged-daemon vulnerabilities or equivalent exploit components.

The work is focused on real trust boundaries exposed through Mach, XPC, private frameworks, privileged services and entitlement-gated functionality. This is not an application-security or jailbreak-usage role.

What you’ll work on

• Privileged iOS daemons, frameworks and services reachable from sandboxed application or browser contexts.
• Mach, XPC, NSXPC, serialisation and object-bridging boundaries.
• Memory corruption, logic vulnerabilities, confused-deputy conditions, race conditions and entitlement bypasses.
• Sandbox profiles, service registration, entitlement checks and cross-process trust relationships.
• Private-framework and daemon-protocol reverse engineering across iOS releases and arm64e devices.
• Exploit-chain integration with browser and kernel researchers when required.

What you’ll deliver

• Original iOS userspace vulnerabilities that cross sandbox, entitlement, process or service boundaries.
• Reliable sandbox-escape exploit components suitable for integration into broader chains.
• Prioritised attack-surface maps for privileged services, framework brokers and entitlement-gated functionality.
• Triggers, PoCs, exploitation strategy, affected-version notes, assumptions and clear technical handover.
• Reusable tooling for service discovery, message generation, daemon instrumentation, entitlement analysis and variant research.

What we’re looking for

• Proven delivery of iOS sandbox escapes, privileged-daemon vulnerabilities or comparable userspace exploit components.
• Deep knowledge of iOS process isolation, code signing, entitlements, sandbox profiles and launch/service models.
• Strong reverse engineering across Objective-C, Swift and C/C++, including private frameworks and stripped binaries.
• Practical expertise with Mach messaging, XPC/NSXPC, serialisation formats and asynchronous service interactions.
• Advanced ARM64/arm64e userspace exploitation, including modern heap behaviour, PAC-aware strategies and constrained code execution.
• The ability to reason about chainability, target variation and reliability rather than stopping at a one-time daemon crash.
• A consistent history of independently finishing complex research.
• Strong signals
• Public iOS security credits, jailbreak-chain research or comparable exploit-chain delivery.
• Experience chaining browser compromise into an iOS userspace sandbox escape.
• Custom XPC/Mach fuzzing, service-introspection or firmware-analysis tooling.
• Research across multiple major iOS generations and arm64e hardware families.
• Strong patch-diffing and variant-hunting results.
• How we work
• Fully remote, with high autonomy and direct collaboration with browser and kernel specialists.
• We value technically meaningful delivery, clean handover and reproducibility over activity metrics or polished theatre.
• Public CVEs are useful but not required.