Malware Researcher (on-site)

The role

The Malware Researcher will analyze malware samples statically and dynamically to improve machine learning based detection. They will hunt for coverage gaps, propose detection features, and curate training datasets.

What you will do

• Analyze malware samples, statically and dynamically, to improve machine learning based detection
• Root-cause false positives and misses in malware detection engines
• Hunt for coverage gaps across malware families, file types, and toolchains
• Run adversarial tests against detectors
• Turn confirmed gaps into prioritized plans for the ML team
• Propose and validate detection features, YARA rules, and heuristics
• Curate and quality-check training and evaluation datasets
• Validate detection changes before release

Required qualifications

• 3+ years in malware analysis, threat research, or detection engineering
• Bachelor’s degree in Computer Science, Information Security, or a related field, or an equivalent hands-on track record
• Strong static analysis skills: PE internals first, plus ELF/Mach-O, packing and obfuscation indicators
• Hands-on with YARA, IDA/Ghidra/radare2, pefile/LIEF, and dynamic analysis in a sandbox
• Fluency with malware families, campaigns, and TTPs; MITRE ATT&CK as working vocabulary
• Python good enough to automate your own analysis at scale
• Clear written English

Nice to have

• Understanding of how ML classifiers fail and get evaded (drift, label noise, adversarial samples), or experience alongside an ML detection team
• Reverse engineering depth: unpacking, anti-analysis defeat, shellcode, obfuscated scripts
• Familiarity with threat intel platforms and sample feeds (VirusTotal, MalwareBazaar, MISP)
• Exposure to non-PE threats: documents, macros, archives, scripts
• Certifications or public work (GREM, OSCP, conference talks, published research)

About the company

OPSWAT is a global leader in IT, OT, and ICS critical infrastructure cybersecurity. They deliver an end-to-end platform to protect complex networks, secure devices, and ensure compliance.