[Hiring] Senior Detection Engineer @Spamhaus

Role Description

As a key addition to the Cyber Threat Intelligence Focus Unit (CTI FU) team, you will:

• Write, test, and maintain high-fidelity detection rules (such as YARA) with low false-positive rates, optimized for scalable deployment across continuous detection and retrohunt pipelines.
• Own the quality of detection rule sets, including rule verification, false-positive risk assessment, and performance testing.
• Reverse engineer Windows and Linux malware, including emerging families, packers, and obfuscated payloads, to understand their behaviour, uncover configuration structures, and identify opportunities for detection and intelligence extraction.
• Develop and maintain malware configuration extractors and parsers to automatically recover command-and-control (C2) infrastructure, campaign identifiers, and other relevant intelligence from files.
• Work with developers to support our in-house sandbox with better detection capabilities and ensure proper output when detonating modern threats.
• Supervise and review the work of any interns or other junior team members, setting their priorities and giving regular feedback.
• Where appropriate, share findings with the wider security community, working with marketing to produce content and present at appropriate events.

Qualifications

• 5+ years of professional experience in Malware Analysis, Reverse Engineering, or Detection Engineering.
• Expert-level experience writing detections using proven tools such as YARA and Suricata, including performance tuning, false-positive management, and testing against large sample sets.
• Proven ability to build your own malware configuration extractors (for example, in Python), including handling common encryption and obfuscation schemes.
• Hands-on experience with malware sandboxes, such as CAPE, and an understanding of how sandbox output feeds detection and extraction workflows.
• Strong reverse engineering skills using disassemblers, decompilers, and debuggers, and knowledge of packers and common obfuscation methods.
• Knowledge of Windows and Linux OS internals and of the network protocols commonly used by malware families.
• Proficiency in Python, plus familiarity with Assembly (x86/x64), C, and at least one of Go or Rust.
• The ability to set your own research priorities, recommend direction based on client and product focus, and guide a less experienced colleague.
• Strong written and verbal communication in English, including explaining technical findings to developers and non-technical colleagues.

Requirements

• Experience with sandbox development or sandbox internals in general, including hardening and anti-evasion techniques. Drakvuf experience would be ideal, but is not critical.
• Experience with sandbox environment hardening and anti-evasion techniques.
• Familiarity with large-scale YARA scanning and retrohunt platforms such as VirusTotal and Censys.
• A public track record of research, rules, or tooling (for example, conference talks, blogs, or open-source contributions).

Benefits

• Competitive salary.
• Excellent annual leave allowance.
• Opportunity to work in a dynamic and supportive environment.
• Flexible working hours and remote work setup.

Location

European-based. Everyone at Spamhaus works from home; however, global travel is required approximately three times a year for face-to-face meetings and event attendance.

Contract

Permanent.