Threat Research – Tier 1

Monarx•Salt Lake City, UT

1d•Remote

About The Position

Monarx protects websites from malware and web-based attacks. Its flagship product, ThreatShield, runs at the server level and is offered through hosting partners around the world. The Threat Research team turns platform signals into protection by hunting new malware, reviewing files and requests flagged by hosting partners, cleaning compromised sites, and improving detection based on its findings. Analysts rotate through daily assignments across research, partner support, and cleanups. The Threat Research – Tier 1 analyst identifies malicious code, cleans infected websites, handles incidents end to end within SLA, and escalates complex issues to Tier 2 or Engineering. The role involves analyzing suspicious code, investigating how websites were compromised, and clearly explaining findings to hosting partners. It is fully remote in the Americas, full-time, Monday through Friday, 40 hours per week. The company provides a computer, and the role requires fluent written and spoken English. Monarx describes its culture as decentralized. Success means learning the platform, tools, and procedures and shadowing each daily rotation during the first 30 days; independently handling file reviews, cleanups, and partner requests within SLA, with documented escalations, by the first 90 days; and continuing to contribute malware findings and process improvements.

Requirements

1–2 years of experience in web security, malware analysis, incident response, or a technical support role with a security focus.
Hands-on experience identifying and removing website malware, especially from WordPress sites.
Experience troubleshooting and repairing broken WordPress sites, including white screens, fatal errors, plugin and theme conflicts, database connection errors, and broken updates.
Ability to read PHP and JavaScript, including obfuscated code.
Working knowledge of Linux and the command line, including grep, find, file permissions, and log review.
Understanding of web servers, DNS, and databases such as MySQL/MariaDB.
Familiarity with common web attack vectors, including vulnerable plugins, file upload abuse, SQL injection, XSS, and credential stuffing.
Experience working a ticket queue against SLAs and knowing when to escalate.
Fluent written and spoken English for tickets, incident summaries, partner calls, and team communication.

Nice To Haves

Experience at a hosting company, web security vendor, or managed WordPress provider.
Experience with other CMS and e-commerce platforms, such as Magento, Joomla, Drupal, OpenCart, and PrestaShop.
Experience writing or tuning detection rules, such as YARA or regex signatures.
Bash or Python scripting experience for automating analysis and cleanup tasks.
Familiarity with cPanel, Plesk, or other hosting control panels.
Experience with support platforms such as Intercom and Slack-based customer channels.
Spanish or Portuguese language skills to support partners across the Americas.
Security certifications or coursework, such as Security+ or GCIH.

Responsibilities

Analyze suspicious files and requests flagged by the Monarx platform and hosting partners, classifying them as malicious, suspicious, or clean.
Identify common web malware, including backdoors, webshells, SEO spam, phishing kits, credit card skimmers, and malicious redirects.
Deobfuscate PHP and JavaScript to understand malware samples, document new findings, and share them with the team to improve detection.
Clean compromised websites, especially WordPress and other common CMS sites, removing malicious code, files, and database injections without disrupting site functionality.
Investigate likely points of entry, such as vulnerable plugins, stolen credentials, and outdated core software, and recommend hardening steps.
Respond to active security incidents by containing threats, preserving evidence, and restoring a clean state.
Write clear incident summaries for hosting partners and internal teams.
Serve as a technical point of contact for hosting partners regarding file reviews, detections, and cleanup requests; explain findings and recommend next steps.
Help investigate possible false positives and report them for root cause analysis.
Work the alert and request queue to ensure items are acknowledged, updated, and resolved within SLA, keeping tickets accurate and current in support tools.
Escalate complex, widespread, or product-related issues to Tier 2 or Engineering with complete context.
Participate in rotating daily assignments across research, partner support, and cleanups.