Senior Detection Engineer

This is a fully remote position, open to applicants in Europe.

📋 Description

• Create, test, and sustain high-fidelity detection rules like YARA, ensuring low false-positive rates.

• Enhance detection rules for scalable application across continuous detection and retrohunt pipelines.

• Take ownership of the quality of detection rule sets, which includes rule verification, false-positive risk assessment, and performance testing.

• Reverse engineer malware targeting Windows and Linux systems, focusing on emerging families, packers, and obfuscated payloads.

• Spot opportunities for detection and intelligence extraction.

• Develop and manage malware configuration extractors and parsers.

• Retrieve command-and-control infrastructure, campaign identifiers, and other intelligence from files.

• Collaborate with developers to enhance the detection capabilities of the in-house sandbox.

• Ensure accurate output when analyzing modern threats.

• Oversee and evaluate interns or junior team members, establish priorities, and provide constructive feedback.

• Share insights with the broader security community when relevant.

• Partner with marketing to generate content and represent the company at suitable events.

⛳️ Requirements

• Over 5 years of professional experience in Malware Analysis, Reverse Engineering, or Detection Engineering.

• Expert-level proficiency in writing detections using YARA and Suricata, including performance tuning, false-positive management, and testing against extensive sample sets.

• Capability to develop malware configuration extractors in Python, with a focus on handling common encryption and obfuscation techniques.

• Practical experience with malware sandboxes such as CAPE.

• Comprehension of how sandbox output contributes to detection and extraction workflows.

• Strong reverse engineering abilities using disassemblers, decompilers, and debuggers.

• Familiarity with packers and prevalent obfuscation methods.

• Understanding of Windows and Linux operating system internals.

• Awareness of network protocols frequently employed by malware families.

• Proficiency in Python programming.

• Basic knowledge of Assembly (x86/x64), C, and at least one of Go or Rust.

• Ability to prioritize research and recommend directions based on client and product needs.

• Capability to mentor less experienced colleagues.

• Excellent written and verbal communication skills in English.

• Experience with sandbox development or sandbox internals, particularly hardening and anti-evasion techniques (preferred).

• Experience with Drakvuf (ideal but not mandatory).

• Familiarity with large-scale YARA scanning and retrohunt platforms like VirusTotal and Censys (preferred).

• A public track record of research, rules, or tooling, evidenced by conference presentations, blogs, or open-source contributions (preferred).

🏝️ Benefits

• Competitive salary.

• Generous annual leave entitlement.

• Chance to work in a dynamic and supportive environment.

• Flexible working hours.

• Remote work arrangement.

• Global travel approximately three times a year for in-person meetings and event participation.