Malware Researcher (on-site).

OPSWAT, a global leader in IT, OT, and ICS critical infrastructure cybersecurity, delivers an end-to-end platform that gives public and private sector organizations and enterprises the critical advantage needed to protect their complex networks, secure their devices, and ensure compliance. Over the last 20 years our commitment to innovative technology has earned the trust of more than 1,700 organizations, governments, and institutions globally, solidifying our role in protecting the world’s critical infrastructure and securing our way of life. 

What You Will Be Doing 

• Analyze malware samples, statically and dynamically, and use what you learn to improve our machine learning based detection 

• Root-cause false positives and misses in our malware detection engines down to the failing feature, model, or label 

• Hunt for coverage gaps across malware families, file types, and toolchains, and run adversarial tests (packing, obfuscation, polymorphism, format abuse) against our own detectors 

• Turn confirmed gaps into prioritized plans for the ML team, weighed by prevalence, severity, and false-positive cost, and keep engineering and product informed on coverage and residual risk 

• Propose and validate detection features, YARA rules, and heuristics grounded in observed malware behavior 

• Curate and quality-check training and evaluation datasets: provenance, labeling, family balance 

• Validate detection changes before release and challenge results that look too good 

What We Need From You 

• 3+ years in malware analysis, threat research, or detection engineering 

• Bachelor’s degree in Computer Science, Information Security, or a related field, or an equivalent hands-on track record 

• Strong static analysis skills: PE internals first, plus ELF/Mach-O, packing and obfuscation indicators 

• Hands-on with YARA, IDA/Ghidra/radare2, pefile/LIEF, and dynamic analysis in a sandbox 

• Fluency with malware families, campaigns, and TTPs; MITRE ATT&CK as working vocabulary 

• Python good enough to automate your own analysis at scale 

• Interest in putting your analysis to work in a machine learning detection engine; no ML background required 

• Clear written English 

Nice to Have 

• Understanding of how ML classifiers fail and get evaded (drift, label noise, adversarial samples), or experience alongside an ML detection team 

• Reverse engineering depth: unpacking, anti-analysis defeat, shellcode, obfuscated scripts 

• Familiarity with threat intel platforms and sample feeds (VirusTotal, MalwareBazaar, MISP) 

• Exposure to non-PE threats: documents, macros, archives, scripts 

• Certifications or public work (GREM, OSCP, conference talks, published research)