Staff Security Research Engineer

The role

This highly technical role has a direct and real-time impact on protecting customers.

As a Senior Security Research Engineer on the Threat Research team, you’ll be part of an amazing, collaborative, industry-leading team focused on tracking threat actors, malware, phishing, and TTPs to develop static and dynamic (behavioural) signatures that detect and prevent threats on a massive scale.

If you enjoy keeping abreast of and analysing attacker techniques, malware and phishing campaigns, and using that knowledge to counteract those threats on a broad scale, then this is the role for you.

This role has an absolute and direct impact on the efficacy of products, the quality of intelligence, and the protection of customers.

Your day-to-day

• Stay abreast of a constantly evolving threat landscape including the credential phishing landscape
• Analyse malware, malicious documents, and malicious URLs provided by internal and external sources
• Conduct in-depth analysis of email messages to detect and classify threats such as business email compromise (BEC), phishing, and other malicious campaigns.
• Apply critical thinking skills to identify the most efficient and effective way to mitigate the analysed threat
• Develop, test, and deploy appropriate static and/or behavioural signatures to mitigate the analysed threat
• Identify, prioritize, and fill coverage gaps for relevant threats to minimize customer impact
• Respond to customer FN/FP escalations that cannot be addressed by customer support
• Work effectively as part of a remote team using chat, video chat and conference calls
• Work with engineering teams, defining requirements, for the continuous improvement of critical detection capabilities

What you bring to the team

• A passion for threat research and a well-rounded yet deep understanding of the security threat landscape Demonstrable understanding of the malware and credential phishing landscape, TTPs, and experience overcoming bypass techniques
• Experience proactively identifying, responding to, and defending against malware and credential phishing threats in production environments
• Familiarity with browser internals and the Document Object Model Broad and demonstrable understanding of document formats commonly used for malicious purposes (e.g. OLE, CDFv2, PDF, OpenOffice, RTF)
• Experience parsing and analysing malicious documents Experience leveraging sandbox environments as an analysis tool
• Critical thinking: Able to develop high quality detection signatures based on analysis of malicious behaviour
• Experience creating YARA and/or ClamAV signatures used in production environments
• Regular expression wizardry Intermediate-level Python experience Interest in learning sandbox engineering concepts and contributing ideas to extend capabilities a plus Interest in creating synthetic malicious samples to test capabilities a plus
• Willing and able to work independently and collaboratively as part of a distributed team of industry-leading security researchers A hard-working, self-directed team player fully capable of working remotely