Malware Analyst

Malware Analyst for EDR team at Doctor Web. Office in Saint Petersburg. Salary discussed during interview.

Responsibilities: • Analysis of malware code and behavior on Windows and Linux, reverse engineering • Tracking current threats, campaigns, and attacker techniques (public reports, threat intelligence, fresh samples) • Developing detection rules in Sigma format based on analysis results • Matching malware behavior with EDR telemetry and MITRE ATT&CK techniques • Simulating attacker actions on a virtual stand to test and improve rules • Analyzing rules for false positives and minimizing them • Finding ways to bypass detection and developing solutions • Testing rules for functionality and performance

• Experience in malware analysis and reverse engineering • Knowledge of x86/x64 assembly • Proficiency in static and dynamic analysis tools: IDA Pro and/or Ghidra, debuggers (x64dbg/gdb), sandboxes • Knowledge of Windows architecture (processes, services, registry, WinAPI) and Linux (processes and daemons, system calls, autostart mechanisms) • Knowledge of PE/PE32+ and ELF formats • Understanding of telemetry sources: Windows Event Log, Sysmon, ETW, auditd • Knowledge of Sigma syntax and experience writing detection rules • Knowledge of MITRE ATT&CK matrix • Ability to analyze obfuscated code in scripting languages (PowerShell, JS, VBS, etc.) • Proficiency in Python for automation tasks • Technical English