Malware Reverse Engineer

Overview

Enovise's malware research capability sits at the intersection of threat intelligence, incident response, and offensive operations. As a Malware Reverse Engineer, you will analyse sophisticated malware samples — from commodity stealers to bespoke nation-state implants — to extract intelligence that drives both defensive and offensive outcomes. Your findings will inform threat intelligence reporting, DFIR investigations, and the development of detection logic. You will work in a research-first environment with access to rare samples, high-fidelity sandboxes, and a team of operators and analysts who consume your output directly.

Responsibilities

• Perform static and dynamic analysis of malware samples across Windows, Linux, and embedded platforms.
• Reverse engineer custom implants, loaders, packers, and C2 frameworks using IDA Pro, Ghidra, Binary Ninja, or equivalent.
• Extract indicators of compromise, C2 communication patterns, and capability profiles from analysed samples.
• Produce detailed technical malware reports consumed by threat intelligence, DFIR, and red team teams.
• Develop YARA rules, Sigma detections, and other detection artefacts based on analysis findings.
• Track malware families and their evolution across campaigns to identify infrastructure reuse and actor attribution.
• Collaborate with offensive teams to inform red team tooling development and evasion technique research.

Requirements

• 4+ years of malware analysis or reverse engineering experience in a professional security context.
• Strong proficiency with IDA Pro, Ghidra, or Binary Ninja for static analysis.
• Deep understanding of Windows internals, PE file format, and common evasion and anti-analysis techniques.
• Experience with dynamic analysis platforms, sandbox environments, and behavioural detonation workflows.
• Proficiency in Python for automation, scripting, and analysis tooling development.
• Ability to produce clear, structured technical reports from complex analysis.
• GREM, CREST CCMRE, or demonstrable equivalent research output.

Nice to Have

• Experience analysing Linux or embedded/IoT malware targeting industrial or network infrastructure.
• Familiarity with firmware extraction and analysis.
• Published research, CVEs, or public malware analysis reports.
• Understanding of offensive tooling development, C2 frameworks, and evasion tradecraft.