Careers at Malwagon
Malwagon is in production: real submissions, real detonations, on hardware we own. The detection coverage and the commercial pipeline are still the work of the person who built the platform. That is what these roles are for.
- Team
- Small. Every role here works directly with the person who built the platform, and there is no HR layer in between.
- Where
- Remote, and only remote. Hours are yours: no fixed schedule and no required overlap. Say in your first mail how you would want to be contracted.
- Working language
- English for code, identifiers, comments, rules and reports, and for anything else written down. Tell us which languages you work in.
- What you would work on
- An analysis platform in production: real submissions, real detonations, hardware we own and operate rather than rented capacity.
- Stage
- Early. The engine and the paid path are built and running; the pipeline and the detection coverage are not finished, which is why these roles exist.
- First reply
- Within ten working days, either way, from the person who would work with you.
Open roles
Each card carries the date it was posted and links to the full description; the reference code is what an application is filed under.
Engineering
-
Our detection is only as good as what we can throw at it, and today nobody writes the hard cases.
First 90 daysA running corpus of techniques across every image, with a written expectation per sample and the first honest list of what we do not see.
-
A signed, benign build once scored 80 out of 100 here. You would own the number, not just the write-up.
First 90 daysThe suspicious baseline either justified or removed, with the false positives hiding behind it named one by one.
-
Everything that parses attacker-controlled bytes should be in a language that bounds the damage. Most of ours is not, yet.
First 90 daysOne component moved across with a benchmark and a fuzz target, and its throughput published next to the numbers it replaced.
Go-To-Market
-
The product is live and the payment path works. The pipeline is empty. That gap is the whole job.
First 90 daysA qualified pipeline you built yourself, a written pricing proposal, and the security review pack we do not have today.
-
Most people who open an account never run a single scan. Nobody has ever asked them why.
First 90 daysEvery free-tier account worth a conversation contacted, and the first upgrades that came from one of those conversations.
How hiring runs here
Four steps, which is how many there are. Nobody is screened by a model and there is no interview panel.
-
You write to us
A short mail with the reference code in the subject, a CV or a profile, and a few lines on which part of the role you would take first. No cover letter.
-
We answer
Within ten working days, either way. The person who reads your mail is the person you would work with, not a recruiter and not a screening model.
-
One technical conversation
Ninety minutes about work you have already done, and about a real problem from the role. For the engineering roles you may bring something you built instead; we would rather read it than set a puzzle.
-
A paid exercise, if you want one
Scoped to a day, paid at your rate, and optional on both sides. It exists so that neither of us has to decide on an interview alone.
Pay
We do not publish a band yet, and we are not going to write "competitive" instead. Put the number you need in your first mail. You will get a straight answer about whether we can reach it before either of us spends an hour on this.
Before you write
Three things worth ten minutes. All three are public.
- A finished report
- Open a public analysis and read it end to end. That output is what every role here is ultimately working on.
- How the platform is built
- The analysis modules, the images, and where the telemetry is taken from.
- The security page
- Isolation, what leaves the platform and what never does. Two of those rules constrain the product hard. Tell us in your mail whether you think they are the right call.
How to apply
By email, to one address, read by the person you would work with. There is no form, no account to create and no applicant tracking system in the way. What happens to what you send is set out under candidate data, below.
Write to
Put the reference code in the subject, for example MWD-01 - Malware Developer, Detection Validation. A role with no code in the subject still gets read; the code is what keeps the answer quick.
If nothing here fits and you still think you belong, write with Open application in the subject and say what you would work on.
Send
- The reference code in the subject line.
- A CV, a profile, or a page that shows the work. One of those, not all three.
- A few lines on which part of the role you would take first, and why.
- Links to anything public you are proud of: code, rules, write-ups, talks.
Do not send
- A date of birth, a photograph, a marital status, a gender, a national identity or social security number, or a home address.
- Anything about health, religion, ethnicity, politics or union membership. We will not read it and we do not want to hold it.
- Scans of identity documents, diplomas or payslips. If any of that is ever needed it is at an offer, not at an application.
- A referee's name, number or address. That is somebody else's personal data and it is not yours to hand over; we will ask you for it if we get that far.
- Archives, macro-enabled documents or executables. Send a link instead - this mailbox belongs to a malware analysis company and attachments are treated accordingly.
Candidate data
This is the notice you are owed at the moment you send us something, under Article 13 of the GDPR. It covers applications only. Everything else the platform does with data is in the privacy policy.
- Who holds it
- The controller is Malwagon: the service described on this site, run by the person who operates the hardware. Contact for anything in this notice, including every right below, is [email protected].
- What we process, and why
- Whatever you choose to put in your mail: your name, your address, the links you send, and the contents of a CV or profile if you attach one. It is processed to assess your application and to talk to you about it, and for nothing else. It is never used to train a model, never sold and never passed to a recruiter.
- On what basis
- For a named role, taking steps at your request before entering a contract (Article 6(1)(b)), and our legitimate interest in filling the role (Article 6(1)(f)). For an open application, your consent, which you may withdraw at any time by writing to the address above.
- Who sees it
- The person who would work with you, and nobody else. The mailbox is run by our email provider, which handles the message on our instructions purely to deliver and store it. That provider may operate outside your country, which for an applicant in the EEA or the United Kingdom means a transfer abroad made under the provider's own safeguards; the transfers section of the privacy policy describes the mechanisms, and you can ask us for a copy. No application is shared with a recruiter, an agency or anyone else, and none is published. Your link is never put through the analysis platform, and your mail never goes into the contact form's queue.
- How long it is kept
- Six months from our last message to you, then deleted, unless you ask us to keep it longer so we can come back to you about a future role. If you ask for that, we keep it for twelve months and delete it after that. If you ask us to delete it, we delete it and keep nothing but the fact that a deletion was carried out.
- No automated decisions
- A person reads every application. Nothing here is scored, ranked or filtered by a model, so there is no automated decision with a legal or similarly significant effect within the meaning of Article 22.
- Your right to object
- Where we rely on a legitimate interest, you may object to the processing at any time, and we will stop unless we can show a compelling ground that overrides your interests. This is set out separately because the law requires it to be, and not because it is less likely to be used than the rest.
- Your other rights
- Access, rectification, erasure, restriction and portability, and the right to withdraw consent where consent is the basis, which here means an application we are holding at your request. Write to the address above and you get an answer within thirty days. You can also complain to a supervisory authority: the one where you live, where you work, or where you think the processing went wrong.
- Giving us the data is your choice
- You are not required to send anything. Send less than the list above asks for and we may not be able to assess the application, which is the only consequence. Please do not send any of the categories named under Do not send: we do not need them, and we would have to protect and delete anything that arrives.