OPSWAT

Protects critical infrastructure from malware

Malware Researcher

Security Operations & Incident ResponseConfirmed live in the last 24 hours

Full-timeTimișoara, RomaniaNo salary listedIn-person

About the Job

Requirements

At least 3 years of experience in malware analysis, threat research, or detection engineering.
A bachelor's degree in Computer Science, Information Security, or a related field, or an equivalent hands-on track record.
Strong static analysis skills, especially PE internals, as well as ELF/Mach-O, packing, and obfuscation indicators.
Hands-on experience with YARA, IDA, Ghidra, or radare2; pefile or LIEF; and dynamic analysis in a sandbox.
Fluency with malware families, campaigns, and TTPs, using MITRE ATT&CK as working vocabulary.
Python skills sufficient to automate analysis at scale.
Clear written English.

Responsibilities

Analyze malware samples statically and dynamically and use findings to improve machine-learning-based detection.
Root-cause false positives and misses in malware detection engines down to the failing feature, model, or label.
Hunt for coverage gaps across malware families, file types, and toolchains, and run adversarial tests—including packing, obfuscation, polymorphism, and format abuse—against internal detectors.
Turn confirmed gaps into prioritized plans for the machine-learning team, weighing prevalence, severity, and false-positive cost, and keep engineering and product informed about coverage and residual risk.
Propose and validate detection features, YARA rules, and heuristics grounded in observed malware behavior.
Curate and quality-check training and evaluation datasets for provenance, labeling, and family balance.
Validate detection changes before release and challenge results that appear overly positive.

Desired Qualifications

Understanding how machine-learning classifiers fail and are evaded, including drift, label noise, and adversarial samples, or experience working alongside a machine-learning detection team.
Reverse-engineering depth, including unpacking, defeating anti-analysis techniques, shellcode, and obfuscated scripts.
Familiarity with threat-intelligence platforms and sample feeds such as VirusTotal, MalwareBazaar, and MISP.
Exposure to non-PE threats, including documents, macros, archives, and scripts.
Certifications or public work such as GREM, OSCP, conference talks, or published research.

OPSWAT, a global leader in IT, OT, and ICS critical infrastructure cybersecurity, delivers an end-to-end platform that gives public and private sector organizations and enterprises the critical advantage needed to protect their complex networks, secure their devices, and ensure compliance. Over the last 20 years our commitment to innovative technology has earned the trust of more than 1,700 organizations, governments, and institutions globally, solidifying our role in protecting the world’s critical infrastructure and securing our way of life.

What You Will Be Doing

Analyze malware samples, statically and dynamically, and use what you learn to improve our machine learning based detection

Root-cause false positives and misses in our malware detection engines down to the failing feature, model, or label

Hunt for coverage gaps across malware families, file types, and toolchains, and run adversarial tests (packing, obfuscation, polymorphism, format abuse) against our own detectors

Turn confirmed gaps into prioritized plans for the ML team, weighed by prevalence, severity, and false-positive cost, and keep engineering and product informed on coverage and residual risk

Propose and validate detection features, YARA rules, and heuristics grounded in observed malware behavior

Curate and quality-check training and evaluation datasets: provenance, labeling, family balance

Validate detection changes before release and challenge results that look too good

What We Need From You

3+ years in malware analysis, threat research, or detection engineering

Bachelor’s degree in Computer Science, Information Security, or a related field, or an equivalent hands-on track record

Strong static analysis skills: PE internals first, plus ELF/Mach-O, packing and obfuscation indicators

Hands-on with YARA, IDA/Ghidra/radare2, pefile/LIEF, and dynamic analysis in a sandbox

Fluency with malware families, campaigns, and TTPs; MITRE ATT&CK as working vocabulary

Python good enough to automate your own analysis at scale

Interest in putting your analysis to work in a machine learning detection engine; no ML background required

Clear written English

Nice to Have

Understanding of how ML classifiers fail and get evaded (drift, label noise, adversarial samples), or experience alongside an ML detection team

Reverse engineering depth: unpacking, anti-analysis defeat, shellcode, obfuscated scripts

Familiarity with threat intel platforms and sample feeds (VirusTotal, MalwareBazaar, MISP)

Exposure to non-PE threats: documents, macros, archives, scripts

Certifications or public work (GREM, OSCP, conference talks, published research)

OPSWAT is an equal opportunity employer. We celebrate diversity and are committed to providing an environment where equal employment opportunities are extended to all employees and applicants, free of discrimination and harassment of any type. All employment decisions are based on individual qualifications, job requirements, and business needs without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other category protected by federal, state, or local laws.

Recruiting Agencies: we do not accept unsolicited resumes from third party agencies for any of our open positions. To submit resumes for our jobs, there must be a recruiting contract approved by our legal team and endorsed by both parties. We are currently not accepting additional 3rd party agencies at this time.

About the Company

OPSWAT

Protects critical infrastructure from malware

OPSWAT provides cybersecurity solutions that protect critical infrastructure from malware and zero-day attacks by focusing on threat prevention and secure data transfer. Its products secure files and devices at all stages—entry, exit, and rest—ensuring secure access and safe data exchange. The company differentiates itself through deep specialization in high-risk sectors like energy, finance, and government, and by achieving widespread trust (notably 98% of U.S. nuclear power facilities) for its compliance-driven approach. Its goal is to help organizations maintain secure, compliant operations and minimize the risk of cyber compromise while keeping systems productive.

Company size: 1,001-5,000
Company stage: Growth Equity (Venture Capital)
Total funding: $125M
Headquarters: Tampa, FL
Founded: 2002

Recently Posted Jobs

Explore more opportunities at OPSWAT

See more jobs