iOS User Space Sandbox Escape - Vulnerability Researcher

iOS User Space Sandbox Escape - Vulnerability Researcher at Trenchant — Remote

  • Company: Trenchant
  • Location: Remote
  • Employment type: Full-time
  • Posted: 2026-07-31

About this role

Remote position open to candidates located in the United States.

We are looking for a deeply experienced iOS userspace researcher who has already delivered sandbox escapes, privileged-daemon vulnerabilities or equivalent exploit components.

The work is focused on real trust boundaries exposed through Mach, XPC, private frameworks, privileged services and entitlement-gated functionality. This is not an application-security or jailbreak-usage role.

What you’ll work on

  • Privileged iOS daemons, frameworks and services reachable from sandboxed application or browser contexts.
  • Mach, XPC, NSXPC, serialisation and object-bridging boundaries.
  • Memory corruption, logic vulnerabilities, confused-deputy conditions, race conditions and entitlement bypasses.
  • Sandbox profiles, service registration, entitlement checks and cross-process trust relationships.
  • Private-framework and daemon-protocol reverse engineering across iOS releases and arm64e devices.
  • Exploit-chain integration with browser and kernel researchers when required.

What you’ll deliver

  • Original iOS userspace vulnerabilities that cross sandbox, entitlement, process or service boundaries.
  • Reliable sandbox-escape exploit components suitable for integration into broader chains.
  • Prioritised attack-surface maps for privileged services, framework brokers and entitlement-gated functionality.
  • Triggers, PoCs, exploitation strategy, affected-version notes, assumptions and clear technical handover.
  • Reusable tooling for service discovery, message generation, daemon instrumentation, entitlement analysis and variant research.

What we’re looking for

  • Proven delivery of iOS sandbox escapes, privileged-daemon vulnerabilities or comparable userspace exploit components.
  • Deep knowledge of iOS process isolation, code signing, entitlements, sandbox profiles and launch/service models.
  • Strong reverse engineering across Objective-C, Swift and C/C++, including private frameworks and stripped binaries.
  • Practical expertise with Mach messaging, XPC/NSXPC, serialisation formats and asynchronous service interactions.
  • Advanced ARM64/arm64e userspace exploitation, including modern heap behaviour, PAC-aware strategies and constrained code execution.
  • The ability to reason about chainability, target variation and reliability rather than stopping at a one-time daemon crash.
  • A consistent history of independently finishing complex research.

Strong signals

  • Public iOS security credits, jailbreak-chain research or comparable exploit-chain delivery.
  • Experience chaining browser compromise into an iOS userspace sandbox escape.
  • Custom XPC/Mach fuzzing, service-introspection or firmware-analysis tooling.
  • Research across multiple major iOS generations and arm64e hardware families.
  • Strong patch-diffing and variant-hunting results.

How we work

  • Fully remote, with high autonomy and direct collaboration with browser and kernel specialists.
  • We value technically meaningful delivery, clean handover and reproducibility over activity metrics or polished theatre.
  • Public CVEs are useful but not required.

Apply on Trenchant's site

Or fast-track your application with a Beaverhand AI interview