Windows Malware Researcher

This is a fully remote position, open to applicants in Poland, +1 more country.

📋 Description

• Evaluate cybersecurity prompts submitted to an AI system that it was unable to confidently classify as benign or malicious.

• Identify the underlying intent and objectives behind each prompt and determine if the purpose is legitimate or harmful.

• Utilize deep domain expertise to assess technical context, specificity, and the potential real-world impact that a response could have for an attacker.

• Label each prompt with an intent classification and provide a clear written explanation in accordance with project guidelines.

• Independently annotate the same prompts as a secondary researcher.

• Escalate cases where there is disagreement among researchers to a reviewer.

• Highlight ambiguous cases, emerging attack techniques, and deficiencies in the guidelines.

• Assist in enhancing project guidelines.

• Contribute to specialized AI safety and robustness evaluation infrastructure by developing scenarios and environments.

⛳️ Requirements

• A minimum of 5 years of demonstrated, hands-on experience in Windows malware analysis and research.

• Strong understanding of Windows internals and the Win32/NT API, including process injection, persistence, privilege escalation, and evasion techniques for EDR/AV.

• Experience with both static and dynamic analysis of PE files, including unpacking, deobfuscation, and utilizing sandboxes and debuggers such as x64dbg, IDA, and Ghidra.

• Familiarity with major malware families and categories: loaders, infostealers, RATs, ransomware, and C2 frameworks.

• Capability to write YARA rules and extract IOCs and TTPs mapped to MITRE ATT&CK.

• Strong analytical judgment to deduce a user's underlying intention from a brief prompt and to differentiate between defensive, educational, and research uses compared to attack preparation.

• Proficient written communication skills in English with the ability to document reasoning succinctly.

• GIAC GREM, eCMAP, or GIAC GCFA certifications are preferred but not mandatory.

• Proven online accomplishments, write-ups, or contributions on platforms such as HackTheBox, Pwn2Own, TryHackMe, Bug Bounty programs, or published security research are advantageous.

🏝️ Benefits

• Benefits offered by SD Solutions; further details can be obtained by reaching out to the company.

• Opportunity to join a freelance contributor pool for scenario and environment development.