Malware Researcher (on-site)

OPSWAT

Timișoara +1 more

On-site

Who this role is best for

Geared toward candidates with production ML experience comfortable with adversarial domain challenges.

Best fit for

Candidates with production ML experience and a background in cybersecurity or adversarial domains
— “Background in cybersecurity, threat detection, or another adversarial domain”
Individuals with strong Python and ML tooling expertise and a track record of deploying models
— “3+ years of hands-on experience as a Machine Learning Engineer, Data Scientist, or Applied Scientist, with models delivered to production”
Professionals who can work collaboratively with engineering and product teams on model deployment and evaluation
— “present results and trade-offs to engineering and product”

Things to consider

The role demands a clear understanding of model evaluation tied to product constraints
— “Define evaluation protocols: metrics, splits, held-out test sets, and thresholds tied to product constraints”

How to stand out

Highlight your experience with model deployment on AWS and MLOps practices in your resume
— “Take models from experiment to production on AWS together with MLOps and software engineers”
Emphasize your ability to maintain reproducibility and document ML experiments thoroughly
— “Keep experiments reproducible and documented, and present results and trade-offs to engineering and product”
Showcase any prior work with file formats, binary analysis, or adversarial domains in your application materials
— “Knowledge of file formats and binary analysis”

Pace · Fast PacedCollaboration · MediumAutonomy · MediumDecision Impact · Team

Derived from job-description analysis by Serendipath's career intelligence engine.

What success looks like

3+ years of hands-on experience as a Machine Learning Engineer, Data Scientist, or Applied Scientist
Bachelor’s or Master’s degree in Computer Science, Mathematics, Statistics, or a related field

Typical background

Strong Python and the scientific stack (NumPy, pandas, scikit-learn, PyTorch or TensorFlow)Solid grounding in statistics and ML fundamentals

Skills & requirements

Required

Machine Learning EngineerData ScientistApplied ScientistPythonScientific Stack (numpy, Pandas, Scikit-learn, Pytorch Or Tensorflow)AWSModel DeploymentMonitoring Deployed ModelsExperiment ReproducibilityPresent Results And Trade-offs

Preferred

Experiment Tracking And Model Registries (mlflow, Weights & Biases)Model Optimization And Packaging For Inference (quantization, Distillation, Onnx, Docker)File Formats And Binary AnalysisBackground In Cybersecurity, Threat Detection, Or Another Adversarial DomainPublications, Open-source Contributions, Or A Competitive ML Track Record

Stack & domain

Machine LearningData ScienceApplied SciencePythonNumPyPandasscikit-learnPyTorchTensorFlowAWSExperiment TrackingModel RegistriesModel OptimizationInference OptimizationFile FormatsBinary AnalysisCybersecurityThreat DetectionCommunicationProblem-solvingITOTICSMalware Research

About the role

Original posting from OPSWAT

OPSWAT, a global leader in IT, OT, and ICS critical infrastructure cybersecurity, delivers an end-to-end platform that gives public and private sector organizations and enterprises the critical advantage needed to protect their complex networks, secure their devices, and ensure compliance. Over the last 20 years our commitment to innovative technology has earned the trust of more than 1,700 organizations, governments, and institutions globally, solidifying our role in protecting the world’s critical infrastructure and securing our way of life.
OPSWAT, a global leader in IT, OT, and ICS critical infrastructure cybersecurity, delivers an end-to-end platform that gives public and private sector organizations and enterprises the critical advantage needed to protect their complex networks, secure their devices, and ensure compliance. Over the last 20 years our commitment to innovative technology has earned the trust of more than 1,700 organizations, governments, and institutions globally, solidifying our role in protecting the world’s critical infrastructure and securing our way of life.
What You Will Be Doing
Analyze malware samples, statically and dynamically, and use what you learn to improve our machine learning based detection
Root-cause false positives and misses in our malware detection engines down to the failing feature, model, or label
Hunt for coverage gaps across malware families, file types, and toolchains, and run adversarial tests (packing, obfuscation, polymorphism, format abuse) against our own detectors
Turn confirmed gaps into prioritized plans for the ML team, weighed by prevalence, severity, and false-positive cost, and keep engineering and product informed on coverage and residual risk
Propose and validate detection features, YARA rules, and heuristics grounded in observed malware behavior
Curate and quality-check training and evaluation datasets: provenance, labeling, family balance
Validate detection changes before release and challenge results that look too good
What We Need From You
3+ years in malware analysis, threat research, or detection engineering
Bachelor’s degree in Computer Science, Information Security, or a related field, or an equivalent hands-on track record
Strong static analysis skills: PE internals first, plus ELF/Mach-O, packing and obfuscation indicators
Hands-on with YARA, IDA/Ghidra/radare2, pefile/LIEF, and dynamic analysis in a sandbox
Fluency with malware families, campaigns, and TTPs; MITRE ATT&CK as working vocabulary
Python good enough to automate your own analysis at scale
Interest in putting your analysis to work in a machine learning detection engine; no ML background required
Clear written English
Nice to Have
Understanding of how ML classifiers fail and get evaded (drift, label noise, adversarial samples), or experience alongside an ML detection team
Reverse engineering depth: unpacking, anti-analysis defeat, shellcode, obfuscated scripts
Familiarity with threat intel platforms and sample feeds (VirusTotal, MalwareBazaar, MISP)
Exposure to non-PE threats: documents, macros, archives, scripts
Certifications or public work (GREM, OSCP, conference talks, published research)
OPSWAT is an equal opportunity employer. We celebrate diversity and are committed to providing an environment where equal employment opportunities are extended to all employees and applicants, free of discrimination and harassment of any type. All employment decisions are based on individual qualifications, job requirements, and business needs without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other category protected by federal, state, or local laws.
Recruiting Agencies: we do not accept unsolicited resumes from third party agencies for any of our open positions. To submit resumes for our jobs, there must be a recruiting contract approved by our legal team and endorsed by both parties. We are currently not accepting additional 3rd party agencies at this time.

Source: OPSWAT careers