Windows Malware Researcher

About the role

SD Solutions, a global staffing company, is recruiting on behalf of its SafetyTech client for a Windows Malware Researcher. The role sits in the security research division and focuses on determining the true intent behind cybersecurity prompts submitted to an AI system that could not confidently classify them as benign or malicious. It is a full-time, remote position based in Poland or Bulgaria.

Key responsibilities

• Review cybersecurity prompts that the AI system could not confidently classify as benign or malicious.
• Determine the underlying intent and goal of each prompt and assess whether the user is pursuing a legitimate purpose or an intent to cause harm.
• Use deep domain expertise to judge the technical context, specificity and potential real-world impact of a response for an attacker.
• Annotate each prompt with an intent label and a clear written rationale, following project guidelines.
• Annotate the same prompts independently as a second researcher; disagreements are escalated to a reviewer.
• Flag ambiguous cases, emerging attack techniques and gaps in the guidelines, and help improve them.

Required profile

• Minimum of 5 years of proven, hands-on experience in Windows malware analysis and research.
• Independent, detail-oriented, organized, eager to learn and to research and solve complex problems.
• Clear written communication in English, able to document reasoning concisely.

Required skills

• Strong command of Windows internals and the Win32/NT API, including process injection, persistence, privilege escalation and EDR/AV evasion techniques.
• Static and dynamic analysis of PE files, including unpacking, deobfuscation and sandbox/debugger use (x64dbg, IDA, Ghidra).
• Experience with malware families such as loaders, infostealers, RATs, ransomware and C2 frameworks.
• Ability to write YARA rules and extract IOCs and TTPs mapped to MITRE ATT&CK.
• Nice to have: GIAC GREM, eCMAP, GIAC GCFAD, and demonstrated achievements or write-ups on HackTheBox, Pwn2Own, TryHackMe, bug bounty programs or published security research.