CareersEngineering
Systems Engineer, Rust and Go
Everything that parses attacker-controlled bytes should be in a language that bounds the damage. Most of ours is not, yet.
Other names for this work: Backend Systems Engineer, Rust Engineer or Go Engineer.
Malwagon is hiring: Systems Engineer, Rust and Go. The role stays open until it is filled, and an application is one email to [email protected] with SYS-01 in the subject.
The application is Django, Celery and Postgres and that is not changing. What should change is the hot path and everything that touches hostile input: the collector that ingests kernel telemetry out of a detonating guest, the parsers that walk PE, ELF, OLE and archive structures, the capture pipeline, and the command line client people install.
You would move those to Rust and Go one piece at a time, with a measurement before and after. Two numbers matter here: how long an analyst waits, and how much of our attack surface is a hand-written parser in a language that will not stop a malformed field.
This is systems work on real machines. QEMU and libvirt, kernel tracing, named pipes and ring buffers, a host that is already full, and a telemetry path that must not drop a record when a guest reverts underneath it.
What you would own
- The telemetry collector and its wire format, in a memory-safe language.
- The parsers that run on attacker-controlled bytes, with the fuzz targets that keep them honest.
- The command line client, and the latency budget of a submitted scan.
What you need
- You have shipped production Rust or Go that handles untrusted input.
- You are comfortable with FFI, a profiler, and reading somebody else's C.
- You measure before you rewrite, and you will say out loud when a rewrite is not worth it.
Useful, not required
- Windows internals, eBPF, or QEMU and libvirt experience.
Tools and areasRust, Go, systems programming, parsers, fuzzing, profiling, QEMU, libvirt, Linux internals
One component moved across with a benchmark and a fuzz target, and its throughput published next to the numbers it replaced.
- Terms
- Mid to senior, and 100% remote. Flexible hours: no fixed schedule and no required overlap. A formal qualification is not required either, so the list of what you need is the whole requirement.
- Pay
- We do not publish a band yet, and we are not going to write "competitive" instead. Put the number you need in your first mail. You will get a straight answer about whether we can reach it before either of us spends an hour on this.
How to apply for SYS-01, Systems Engineer, Rust and Go
By email, to one address, read by the person you would work with.
Subject line: SYS-01 - Systems Engineer, Rust and Go. The link above fills it in for you.
What you send is read by the person who would work with you, kept for six months from our last message to you, never shared with anyone and never published. Ask and we delete it sooner. The full candidate data notice says the rest.
Send
- The reference code in the subject line.
- A CV, a profile, or a page that shows the work. One of those, not all three.
- A few lines on which part of the role you would take first, and why.
- Links to anything public you are proud of: code, rules, write-ups, talks.
Do not send
- A date of birth, a photograph, a marital status, a gender, a national identity or social security number, or a home address.
- Anything about health, religion, ethnicity, politics or union membership. We will not read it and we do not want to hold it.
- Scans of identity documents, diplomas or payslips. If any of that is ever needed it is at an offer, not at an application.
- A referee's name, number or address. That is somebody else's personal data and it is not yours to hand over; we will ask you for it if we get that far.
- Archives, macro-enabled documents or executables. Send a link instead - this mailbox belongs to a malware analysis company and attachments are treated accordingly.
-
You write to us
A short mail with the reference code in the subject, a CV or a profile, and a few lines on which part of the role you would take first. No cover letter.
-
We answer
Within ten working days, either way. The person who reads your mail is the person you would work with, not a recruiter and not a screening model.
-
One technical conversation
Ninety minutes about work you have already done, and about a real problem from the role. For the engineering roles you may bring something you built instead; we would rather read it than set a puzzle.
-
A paid exercise, if you want one
Scoped to a day, paid at your rate, and optional on both sides. It exists so that neither of us has to decide on an interview alone.
The other open roles
- Malware Developer, Detection Validation Engineering
- Malware Analyst Engineering
- Enterprise Sales Manager Go-To-Market
- Sales Representative Go-To-Market
What happens to what you send is set out under candidate data, next to the other open roles.