CareersEngineering
Malware Developer, Detection Validation
Our detection is only as good as what we can throw at it, and today nobody writes the hard cases.
Other names for this work: Offensive Tooling Engineer, Red Team Tooling Engineer or Adversary Emulation Engineer.
Malwagon is hiring: Malware Developer, Detection Validation. The role stays open until it is filled, and an application is one email to [email protected] with MWD-01 in the subject.
You build the adversary side of the platform: loaders, droppers, injection chains, persistence, anti-analysis and sandbox detection, in C, C++, assembly, C# and PowerShell, so that the verdict engine has something honest to be measured against.
Everything you write runs in our own isolated guests and nowhere else. It is never delivered to anyone, never carries a live payload and never leaves the lab network. The point is to break our own detection first, and then to say exactly which layer missed it: the kernel trace, the API monitor, the memory baseline or the network rules.
Expect to spend as much time reading telemetry as writing code. A technique that fires nothing is only an interesting result if you can explain why.
What you would own
- A versioned test corpus: one technique per sample, a written expectation for each, and a diff when coverage moves.
- Evasion cases against the hypervisor layer: timing, CPUID, artefacts and sleep acceleration, and the patches they force into QEMU and SeaBIOS.
- The surface a sample can still see from inside a guest.
What you need
- You have written offensive tooling in a lab and can explain Windows internals from the loader to the kernel boundary.
- You have used ETW, WinDbg or a hypervisor tracer to work out what a binary actually did, not what it claimed to do.
- You can take a missed detection and name the layer that missed it.
- You are comfortable that nothing you build here is ever distributed.
Useful, not required
- Kernel driver work, BYOVD research, or Windows kernel debugging.
Tools and areasWindows internals, C, C++, assembly, C#, PowerShell, ETW, anti-analysis, adversary emulation
A running corpus of techniques across every image, with a written expectation per sample and the first honest list of what we do not see.
- Terms
- Mid to senior, and 100% remote. Flexible hours: no fixed schedule and no required overlap. A formal qualification is not required either, so the list of what you need is the whole requirement.
- Pay
- We do not publish a band yet, and we are not going to write "competitive" instead. Put the number you need in your first mail. You will get a straight answer about whether we can reach it before either of us spends an hour on this.
How to apply for MWD-01, Malware Developer, Detection Validation
By email, to one address, read by the person you would work with.
Subject line: MWD-01 - Malware Developer, Detection Validation. The link above fills it in for you.
What you send is read by the person who would work with you, kept for six months from our last message to you, never shared with anyone and never published. Ask and we delete it sooner. The full candidate data notice says the rest.
Send
- The reference code in the subject line.
- A CV, a profile, or a page that shows the work. One of those, not all three.
- A few lines on which part of the role you would take first, and why.
- Links to anything public you are proud of: code, rules, write-ups, talks.
Do not send
- A date of birth, a photograph, a marital status, a gender, a national identity or social security number, or a home address.
- Anything about health, religion, ethnicity, politics or union membership. We will not read it and we do not want to hold it.
- Scans of identity documents, diplomas or payslips. If any of that is ever needed it is at an offer, not at an application.
- A referee's name, number or address. That is somebody else's personal data and it is not yours to hand over; we will ask you for it if we get that far.
- Archives, macro-enabled documents or executables. Send a link instead - this mailbox belongs to a malware analysis company and attachments are treated accordingly.
-
You write to us
A short mail with the reference code in the subject, a CV or a profile, and a few lines on which part of the role you would take first. No cover letter.
-
We answer
Within ten working days, either way. The person who reads your mail is the person you would work with, not a recruiter and not a screening model.
-
One technical conversation
Ninety minutes about work you have already done, and about a real problem from the role. For the engineering roles you may bring something you built instead; we would rather read it than set a puzzle.
-
A paid exercise, if you want one
Scoped to a day, paid at your rate, and optional on both sides. It exists so that neither of us has to decide on an interview alone.
The other open roles
- Malware Analyst Engineering
- Enterprise Sales Manager Go-To-Market
- Sales Representative Go-To-Market
- Systems Engineer, Rust and Go Engineering
What happens to what you send is set out under candidate data, next to the other open roles.