Malware Analyst - Assistant Vice President

What you'll do

• Conduct in-depth analysis of malware involved in active security incidents, including ransomware and advanced persistent threats.
• Execute static and dynamic analysis, reverse engineering, and behavioral analysis of malware across Windows, Linux, and macOS.
• Identify threat actor TTPs to develop containment strategies and support rapid eradication and remediation efforts.
• Document technical findings to contribute to internal threat intelligence reports for technical peers and incident communication.
• Develop new analytical techniques, automate analysis workflows, and create custom tools to enhance team capabilities.
• Create and improve detection signatures, such as YARA rules, based on malware analysis findings.
• Translate malware behavior and artifacts into actionable threat intelligence and comprehensive threat reports.

What we're looking for

• Proven experience conducting in-depth static and dynamic malware analysis, reverse engineering, and behavioral analysis in an enterprise environment.
• Hands-on expertise with industry-standard tools including IDA Pro, Ghidra, x64dbg, malware sandboxes, Wireshark, and Process Monitor.
• Proficiency in at least one scripting language such as Python or PowerShell for automating analysis tasks and developing custom tools.
• Deep understanding of Windows and Linux operating system internals, memory management, process execution, and network protocols.
• Ability to leverage AI tools to optimize workflows while ensuring responsible and ethical use of data.
• Proven experience with advanced reverse engineering techniques including obfuscation bypass, anti-analysis trick identification, and unpacking complex malware (preferred).
• Strong understanding of the incident response lifecycle, MITRE ATT&CK Framework, and cloud-specific threats in AWS, Azure, or GCP (preferred).
• Bachelor’s degree in computer science, Information Security, or a related field, or equivalent professional experience.
• One or more certifications such as GREM, OSCP, or OSCE (preferred).