Description
Join the team behind Recorded Future's Triage malware analysis sandbox as a Senior Malware Analyst. You will analyze the latest malware samples and implement new signatures, YARA rules, and features in Recorded Future's state-of-the-art malware analysis sandbox. Your research will become operational intelligence and detection coverage used by security teams worldwide.
Responsibilities:
- Triage and investigate samples surfaced by the sandbox to discover new and emerging malware families.
- Perform static and dynamic analysis of malicious samples across Windows, macOS, and Android platforms.
- Write and maintain YARA rules to reliably detect malware families and variants.
- Develop and maintain configuration extractors to pull actionable intelligence (C2 servers, campaign IDs, encryption keys, etc.) from malware samples.
- Validate and tune detections to minimize false positives.
- Improve analysis methodology and tooling.
- Influence sandbox features based on malware research.
Requirements:
- Solid understanding of how sandbox systems work (behavioral analysis, hooking, monitoring, evasion detection, etc.).
- Strong knowledge of internals of Windows, Android, or macOS (multiple is a plus) - process/memory model, file formats, APIs, OS-level mechanisms abused by malware.
- Practical experience writing YARA rules, behavioral detection, and config extractors.
- Strong skills in Assembly language.
- Comfortable working asynchronously and independently.
- Familiarity with the Go programming language.
- Prior experience contributing to public or private detection rule sets.