Senior Detection Engineer
Job description
Malware researcher and detection engineer in Spamhaus's Cyber Threat Intelligence Focus Unit, writing and maintaining detection rules, reverse engineering malware, and building configuration extractors for the CTI Hunting Platform.
At a glance
- Employment
- Full-time · Employee (employment agreement)
- Work mode
- Remote · Europe
- Languages
- English – fluent
- Pay
- EUR 70,000 – 110,000 / year
What you'll do
- Write, test, and maintain high-fidelity detection rules (such as YARA) with low false-positive rates, optimized for scalable deployment across continuous detection and retrohunt pipelines.
- Own the quality of detection rule sets, including rule verification, false-positive risk assessment and performance testing.
- Reverse engineer Windows and Linux malware, including emerging families, packers and obfuscated payloads, and identify opportunities for detection and intelligence extraction.
- Develop, maintain malware configuration extractors and parsers to automatically recover command-and-control (C2) infrastructure, campaign identifiers, and other relevant intelligence from files.
- Work with the developers to support our in-house sandbox with better detection capabilities, and ensure proper output when detonating modern threats.
- Supervise and review the work of any interns or other junior team members, setting their priorities and giving regular feedback.
- Where appropriate, share findings with the wider security community, working with marketing to produce content and present at appropriate events.
What we're looking for
- 5+ years of professional experience in Malware Analysis, Reverse Engineering or Detection Engineering.
- Expert-level experience writing detections using proven tools such as YARA and Suricata, including performance tuning, false-positive management and testing against large sample sets.
- Proven ability to build your own malware configuration extractors (for example, in Python), including handling common encryption and obfuscation schemes.
- Hands-on experience with malware sandboxes, such as CAPE, and an understanding of how sandbox output feeds detection and extraction workflows.
- Strong reverse engineering skills using disassemblers, decompilers and debuggers, and knowledge of packers and common obfuscation methods.
- Knowledge of Windows and Linux OS internals and of the network protocols commonly used by malware families.
- Proficiency in Python, plus familiarity with Assembly (x86/x64), C and at least one of Go or Rust.
- The ability to set your own research priorities, recommend direction based on client and product focus, and guide a less experienced colleague.
- Strong written and verbal communication in English, including explaining technical findings to developers and non-technical colleagues.
Nice to have
- Experience with sandbox development or sandbox internals in general, including hardening and anti-evasion techniques. Drakvuf experience would be ideal, but is not critical.
- Experience with sandbox environment hardening and anti-evasion techniques.
- Familiarity with large-scale YARA scanning and retrohunt platforms such as VirusTotal and Censys
- A public track record of research, rules, or tooling (for example, conference talks, blogs, or open-source contributions).
Your team
Cyber Threat Intelligence Focus Unit (CTI FU)
Team members are located across Europe and work closely with our partner abuse.ch. The team is a small group of developers, product specialists and malware researchers, focusing on malware research and building features and functionality for our Cyber Threat Intelligence offering, the CTI Hunting Platform.
Benefits
- Competitive salary.
- Excellent annual leave allowance.
- Opportunity to work in a dynamic and supportive environment.
- Flexible working hours and remote work setup.
Apply
About Spamhaus
Spamhaus, together with its partner abuse.ch, strengthens trust and safety for the Internet. As the market leader in email blocklists (DNSBLs) for the past two decades, it is moving into the broader cyber threat intelligence market. Established over 25 years ago, Spamhaus is still 100% owned by its founder.
Mission
Strengthens trust and safety for the Internet by extracting intelligence from globally sourced signals to provide the community and clients with actionable and timely datasets.
Key facts
- Market leader in email blocklists (DNSBLs) for the past two decades
- Established over 25 years ago (the same year as Google)
- 100% owned by its founder
- Works with partner abuse.ch
Partners & customers
What they value
- Self-motivated
- Start-up mentality
- Hardworking
- Ideas are welcome
- Team members are expected to "get stuck in"
- Fail-fast approach