Malware Reverse Engineer

Booz Allen Hamilton•McLean, VA

2d•Remote

About The Position

Research malware families and threat groups to find new technical indicators and tactics, techniques, and procedures (TTPs) to be used for threat hunting efforts. Perform deep-dive reverse engineering on malware samples using static and dynamic analysis techniques to extract indicators and understand malware capabilities. Develop custom tooling and automation frameworks to accelerate malware analysis workflows, including configuration extraction, deobfuscation, and payload analysis. Leverage AI and agentic frameworks to enhance detection and analysis capabilities. Design and deploy scalable analysis infrastructure in cloud environments. Develop signature and heuristic detection rules to find new malware samples and indicators for threat groups. Leverage expertise in reverse engineering complex malicious code to create technical reports for identification parameters, advanced capabilities, and potential mitigation strategies.

Requirements

6+ years of experience with conducting static and dynamic reverse engineering of malware
4+ years of experience with software development in Python, C, or C++
Experience with using malware reverse engineering to determine indicators of compromise on Linux, Windows, or mobile platforms
Experience with malware reverse engineering using static and dynamic analysis tools, including disassemblers, debuggers, virtual machines, or hex editors
Experience with IDA Pro, Hex-Rays, WinDbg, OllyDbg, or dnSpy
Experience developing custom tools for malware analysis, including configuration extractors, deobfuscators, and payload analysis utilities
Experience writing plugins or scripts for IDA Pro or Ghidra to automate reverse engineering tasks
Experience deploying development environments and analysis labs using cloud infrastructure, such as AWS, Azure, or GCP
Knowledge of the TCP/IP networking stack and network IDS technologies
Ability to obtain a Secret clearance
Bachelor's degree

Nice To Haves

Experience with regular expressions and multiple scripting languages
Experience leveraging AI/ML techniques and agentic frameworks for malware analysis and threat detection
Experience with container technologies, such as Docker and Kubernetes for analysis environment deployment
Experience with infrastructure-as-code tools, such as Terraform and CloudFormation for automated lab provisioning
Experience with automated malware analysis platforms and sandbox technologies
Knowledge of YARA rule development and signature-based detection methodologies

Responsibilities

Research malware families and threat groups to find new technical indicators and tactics, techniques, and procedures (TTPs) to be used for threat hunting efforts.
Perform deep-dive reverse engineering on malware samples using static and dynamic analysis techniques to extract indicators and understand malware capabilities.
Develop custom tooling and automation frameworks to accelerate malware analysis workflows, including configuration extraction, deobfuscation, and payload analysis.
Leverage AI and agentic frameworks to enhance detection and analysis capabilities.
Design and deploy scalable analysis infrastructure in cloud environments.
Develop signature and heuristic detection rules to find new malware samples and indicators for threat groups.
Leverage expertise in reverse engineering complex malicious code to create technical reports for identification parameters, advanced capabilities, and potential mitigation strategies.