Vacancy «Malware Analyst in the EDR team» in Saint Petersburg, working at the company «Dr. Web». Full-time employment.

The EDR team develops detection for current threats on endpoints. We analyze fresh malware samples and attacker techniques, and turn the analysis results into rules that detect attacks by behavior. We are looking for an analyst who is interested in understanding the inner workings of malicious code and writing detections that work in real infrastructures.

Tasks:

• Analysis of Windows and Linux malware code and behavior, reverse engineering;
• Tracking current threats, campaigns, and attacker techniques (public reports, threat intelligence, fresh samples);
• Development of detection rules in Sigma format based on analysis results;
• Correlation of malware behavior with EDR telemetry and MITRE ATT&CK techniques;
• Emulation of attacker actions on a virtual sandbox for testing and improving rules;
• Analysis of rules for false positives and minimization thereof;
• Searching for methods to bypass detection and developing solutions;
• Testing rules for functionality and performance.

Requirements:

• Experience in malware analysis and reverse engineering;
• Knowledge of x86/x64 assembly language;
• Proficiency with static and dynamic analysis tools: IDA Pro and/or Ghidra, x64dbg/gdb debuggers, sandboxes;
• Knowledge of Windows architecture (processes, services, registry, WinAPI) and Linux (processes and daemons, system calls, autostart mechanisms);
• Knowledge of PE/PE32+ and ELF file formats;
• Understanding of telemetry sources: Windows Event Log, Sysmon, ETW, auditd;
• Knowledge of Sigma syntax and experience in writing detection rules;
• Knowledge of the MITRE ATT&CK matrix;
• Ability to analyze obfuscated code in scripting languages (PowerShell, JS, VBS, etc.);
• Proficiency in Python for task automation;
• Technical English;
• Perseverance and ability to complete labor-intensive tasks.

Will be a plus:

• Experience working with EDR, SIEM, or XDR solutions;
• Experience analyzing macOS malware;
• Experience in pentesting or participating in red team exercises;
• Experience writing YARA rules;
• Experience analyzing network traffic.

We offer:

• Official employment;
• Office-based work, flexible start of the workday;
• Modern office on the Petrograd side;
• Competitive salary (discussed individually, depends on experience and qualifications);
• Voluntary medical insurance, including dental care;
• Hot lunches, fruits, drinks;
• Recreation area, exercise equipment, books useful for work.