Malware Reverse Engineer

Spry Methods • Washington, DC

6d

About The Position

We’re looking for a Malware Reverse Engineer to perform advanced malware analysis and reverse engineering to determine maliciousness, capabilities, complexity, and attribution-relevant indicators. This role supports mission needs including identifying C2 infrastructure, extracting IOCs, and producing defensible analysis outputs that can support investigative and legal processes.
The ideal candidate is a deeply technical reverse engineer who can work independently on hard problems, rapidly learn unfamiliar techniques, and communicate complex behavior and conclusions in plain language.

Requirements

• U.S. Citizenship required.
• Active TS clearance with SCI eligibility required.
• Demonstrated hands-on experience with advanced malware reverse engineering across architectures and platforms.
• Ability to work independently on complex problems without higher-tier escalation support; self-directed research and rapid learning.

Nice To Haves

• Proficiency in Python/PowerShell/Bash; additional experience in C/C++, Go, or Rust.
• Familiarity with common malware families and threat actor TTPs; experience building detection content (YARA, behavioral signatures).

Responsibilities

• Conduct static and dynamic analysis of binaries and scripts; reverse engineer across architectures (x86/x64, ARM/ARM64, MIPS, others as needed).
• Analyze packed/obfuscated/encrypted code; build unpacking/decryption routines where required.
• Use tools such as IDA Pro, Ghidra, Binary Ninja, WinDbg, x64dbg, and related debuggers/disassemblers.
• Extract IOCs; develop YARA rules and behavioral signatures to support detection and mitigation.
• Identify persistence mechanisms, anti-analysis, and C2 protocols; assess multi-platform malware (Windows, Linux, macOS, mobile, embedded/IoT).
• Produce thorough documentation of findings and conclusions; communicate clearly to non-expert audiences.
• Successfully complete a mock examination and defend results in a practical courtroom exercise (Government-run).
• Support taskings that may require extended/irregular hours and location-specific needs depending on operational investigative activity.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed
• Number of Employees: 101-250 employees