Senior Malware Reverse Engineer

In this role, you'll work in one of our IBM Consulting, where we deliver deep technical and industry expertise to a wide range of public and private sector clients around the world.  The IBM X-Force Threat Intelligence (XFTI) team provides expert malware and threat analysis to customers globally. As a Malware Reverse Engineer, you will deliver cutting-edge technical analysis and research, generating actionable threat intelligence to empower organizations against advanced and emerging cyber threats, significantly reducing their attack surface.

As a X-Force Malware Reverse Engineer, you will support advanced cyber threat analysis and incident response operations. In this role, you will perform deep technical research on malicious software, uncovering functionality and intent to strengthen detection and response capabilities. You will work closely with IBM X-Force Threat Intelligence and Incident Response teams to deliver high‑impact, actionable insights. Your primary responsibilities will include: 

• Perform expert-level reverse engineering of malware across multiple platforms, analyzing command‑and‑control behavior, communication protocols, encryption methods, persistence mechanisms, and exploit techniques.
• Provide advanced technical analysis and threat research to support X‑Force Threat Intelligence and Incident Response teams, contributing detailed insights during active cyber incidents.
• Develop comprehensive threat models by correlating malware findings with IBM’s proprietary telemetry, open‑source intelligence, and industry threat data. Derive and validate Indicators of Compromise (IOCs) from incident artifacts and malware samples.
• Support incident response efforts with timely, actionable intelligence and recommendations based on in‑depth malware and threat analysis.
• Create automation scripts, primarily in Python, to streamline malware unpacking, configuration extraction, data parsing, IOC generation, and overall analysis workflow efficiency.

• Advanced Malware Reverse Engineering: Experienced in malware reverse engineering and demonstrated expert-level proficiency in advanced malware analysis techniques. This includes manual and automated unpacking of packed/obfuscated executable, rootkit analysis, dissecting complex exploit chains, bypassing sophisticated anti-analysis/evasion mechanisms, and reconstructing malware logic from highly optimized assembly code.
• Programming & Scripting Expertise: Expertise in at least one high-level programming language (e.g., Python, C, C++, Go) for developing analysis tools, automating tasks, scripting debuggers, and parsing complex data structures (e.g., malware configuration blocks, network protocols, cryptographic key values).
• Debugging & Disassembly Tools: Extensive hands-on experience with industry-standard debugging and disassembling tools (e.g., IDA Pro, Ghidra, x64dbg, WinDbg, GDB) for static and dynamic malware analysis, including advanced debugging techniques, scriptable breakpoints, and process injection/hooking.
• Assembly Language Proficiency: Deep, demonstrable expertise in assembly language (x86/x64/ARM/ARM64) and processor architectures, with the ability to swiftly comprehend low-level code, decipher malware behavior, and identify vulnerabilities or exploit mechanisms.
• Signature Development: Proven ability to develop high-fidelity signatures and rules for threat detection and research, including YARA rules, network-based signatures (e.g., Snort/Suricata), and behavioral indicators, to effectively identify and track malware families and activities.

• Malware Platform Breadth: Experience analyzing a wide range of malware file types, including Windows PE, ELF (Linux), MacOS binaries, and mobile platforms (Android/iOS).
• Forensic Artifact Analysis: Proficient in analyzing diverse forensic artifacts, including file system data, system logs, network packet captures, registry hives, and memory dumps, to reconstruct infection chains and and malware activity.
• Malicious Document Analysis: Experience with analyzing malicious documents (e.g., Office macros, PDF exploits) and understanding associated exploitation techniques.
• Operating System Internals: Deep working knowledge of various Operating Systems (Windows internals, macOS, Linux) and processor architectures (x86, x64, ARM, ARM64) relevant to malware execution.
• Threat Intelligence Collaboration: Experience supporting incident response partners, managed security, or threat intelligence teams, and clearly and concisely presenting complex malware analysis findings through high-quality written reports and oral briefings for diverse technical and non-technical audiences.
• Automated Sandbox Familiarity: Familiarity with automated sandbox technologies for dynamic malware analysis (e.g., Cuckoo Sandbox, VMRay, Any.Run).