Malware Analyst
Nozomi Networks is the leader in OT and IoT cybersecurity, keeping the world's critical infrastructure cyber resilient through real-time asset visibility, threat detection, and AI-powered analysis. We protect the toughest operational environments — from energy and healthcare to manufacturing and beyond.
Job Description
As we expand our product portfolio and global presence, our Security Research department is hiring a Malware Analyst to produce accurate threat intelligence and reverse-engineered samples that power solid, reliable detection signatures.
You could be the next "Nozomier"! If this sounds like you, read on.
In this role, you will:
- Perform hands-on static and dynamic analysis of malicious samples to understand their behaviour, capabilities, and intent
- Create and tune various detection rules within our product
- Perform threat intelligence operations to collect and vet all the required knowledge to respond efficiently to advanced threats
- Occasionally contribute to the technical material shared with the public
- Embody the Nozomi Networks Cultural Pillars and our mission to protect what matters most with transparency and trust
To be successful in this opportunity, you will have:
- Previous professional experience as a Detection Engineer, SOC Analyst, or Threat Hunter
- Proven hands-on experience with both static and dynamic malware analysis, including working in isolated/sandboxed environments
- Demonstrated experience analysing Windows malware, including a solid understanding of the Windows executable format (PE) and common execution, persistence, and evasion techniques
- Experience analysing malware in Linux environments, including familiarity with the ELF format and Linux-specific persistence and execution techniques is a strong advantage
- Proven experience in reverse engineering using analysis tools such as IDA Pro, Ghidra, OllyDBG, x64dbg, radare2, or similar
- A solid understanding of binary file attributes such as executable structures and packers
- Experience creating detection signatures such as YARA, Snort or Suricata, STIX, and SIGMA
- Familiarity with the MITRE ATT&CK framework and cyber kill chains
- Understanding of the OSI model and an ability to use Wireshark
- Working knowledge of Python
- The attitude to operate in environments including data covered by non-disclosure agreements and a high level of confidentiality
As we expand our product portfolio and global presence, our Security Research department is hiring a Malware Analyst to produce accurate threat intelligence and reverse-engineered samples that power solid, reliable detection signatures.
You could be the next "Nozomier"! If this sounds like you, read on.
In this role, you will:
- Perform hands-on static and dynamic analysis of malicious samples to understand their behaviour, capabilities, and intent
- Create and tune various detection rules within our product
- Perform threat intelligence operations to collect and vet all the required knowledge to respond efficiently to advanced threats
- Occasionally contribute to the technical material shared with the public
- Embody the Nozomi Networks Cultural Pillars and our mission to protect what matters most with transparency and trust
To be successful in this opportunity, you will have:
- Previous professional experience as a Detection Engineer, SOC Analyst, or Threat Hunter
- Proven hands-on experience with both static and dynamic malware analysis, including working in isolated/sandboxed environments
- Demonstrated experience analysing Windows malware, including a solid understanding of the Windows executable format (PE) and common execution, persistence, and evasion techniques
- Experience analysing malware in Linux environments, including familiarity with the ELF format and Linux-specific persistence and execution techniques is a strong advantage
- Proven experience in reverse engineering using analysis tools such as IDA Pro, Ghidra, OllyDBG, x64dbg, radare2, or similar
- A solid understanding of binary file attributes such as executable structures and packers
- Experience creating detection signatures such as YARA, Snort or Suricata, STIX, and SIGMA
- Familiarity with the MITRE ATT&CK framework and cyber kill chains
- Understanding of the OSI model and an ability to use Wireshark
- Working knowledge of Python
- The attitude to operate in environments including data covered by non-disclosure agreements and a high level of confidentiality
