CareersEngineering
Malware Analyst: Reverse Engineering and Detection
A signed, benign build once scored 80 out of 100 here. You would own the number, not just the write-up.
Other names for this work: Threat Researcher, Reverse Engineer or Detection Engineer.
Malwagon is hiring: Malware Analyst. The role stays open until it is filled, and an application is one email to [email protected] with MWA-01 in the subject.
You own what the verdict says. Triage what arrives, reverse engineer what matters, and turn each result into a rule that holds: one for the file, one for the behaviour, one for the traffic. The platform already generates those from a scan; your job is to make them worth keeping.
Our worst defects are false positives, and the shape is always the same: a rule whose condition is weaker than the sentence it publishes. You would be the person who finds it, proves it wrong against the stored corpus, and rewrites it.
You get hypervisor-level telemetry, memory forensics against a per-image benign baseline, full packet capture with the TLS endpoints recovered, and a live view into the running machine. If a verdict cannot be explained with those, that is our bug.
What you would own
- The rule set and its false positive rate, measured over the stored corpus rather than estimated.
- Triage of incoming samples, and the write-ups that come out of them.
- The scoring ledger: what each analysis layer is allowed to charge, and why.
What you need
- You have reverse engineered Windows malware with a disassembler and a debugger, and can read what a packer did to a binary.
- You have written detection rules that survived contact with real traffic, for the file and for the behaviour.
- You will argue a verdict down as readily as up.
Useful, not required
- Config extraction, maldoc and script deobfuscation, or ATT&CK mapping at scale.
Tools and areasReverse engineering, disassemblers and debuggers, detection rule writing, malware triage, detection engineering
The suspicious baseline either justified or removed, with the false positives hiding behind it named one by one.
- Terms
- Mid to senior, and 100% remote. Flexible hours: no fixed schedule and no required overlap. A formal qualification is not required either, so the list of what you need is the whole requirement.
- Pay
- We do not publish a band yet, and we are not going to write "competitive" instead. Put the number you need in your first mail. You will get a straight answer about whether we can reach it before either of us spends an hour on this.
How to apply for MWA-01, Malware Analyst
By email, to one address, read by the person you would work with.
Subject line: MWA-01 - Malware Analyst. The link above fills it in for you.
What you send is read by the person who would work with you, kept for six months from our last message to you, never shared with anyone and never published. Ask and we delete it sooner. The full candidate data notice says the rest.
Send
- The reference code in the subject line.
- A CV, a profile, or a page that shows the work. One of those, not all three.
- A few lines on which part of the role you would take first, and why.
- Links to anything public you are proud of: code, rules, write-ups, talks.
Do not send
- A date of birth, a photograph, a marital status, a gender, a national identity or social security number, or a home address.
- Anything about health, religion, ethnicity, politics or union membership. We will not read it and we do not want to hold it.
- Scans of identity documents, diplomas or payslips. If any of that is ever needed it is at an offer, not at an application.
- A referee's name, number or address. That is somebody else's personal data and it is not yours to hand over; we will ask you for it if we get that far.
- Archives, macro-enabled documents or executables. Send a link instead - this mailbox belongs to a malware analysis company and attachments are treated accordingly.
-
You write to us
A short mail with the reference code in the subject, a CV or a profile, and a few lines on which part of the role you would take first. No cover letter.
-
We answer
Within ten working days, either way. The person who reads your mail is the person you would work with, not a recruiter and not a screening model.
-
One technical conversation
Ninety minutes about work you have already done, and about a real problem from the role. For the engineering roles you may bring something you built instead; we would rather read it than set a puzzle.
-
A paid exercise, if you want one
Scoped to a day, paid at your rate, and optional on both sides. It exists so that neither of us has to decide on an interview alone.
The other open roles
- Malware Developer, Detection Validation Engineering
- Enterprise Sales Manager Go-To-Market
- Sales Representative Go-To-Market
- Systems Engineer, Rust and Go Engineering
What happens to what you send is set out under candidate data, next to the other open roles.