[Hiring] Threat Research – Tier 1 @Monarx

Role Description

As a Threat Research – Tier 1 analyst, you identify malicious code, clean infected websites, handle incidents end to end within SLA, and escalate to Tier 2 or Engineering when an issue needs deeper investigation. This is a hands-on role for someone who enjoys reading suspicious code, chasing down how a site was compromised, and explaining findings clearly to partners.

What you'll do

• Malware identification:
  • Analyze suspicious files and requests flagged by the Monarx platform and hosting partners, and classify them as malicious, suspicious or clean.
  • Identify common web malware families: backdoors, webshells, SEO spam, phishing kits, credit card skimmers and malicious redirects.
  • Deobfuscate PHP and JavaScript to understand what a sample does.
  • Document new findings and share them with the team to improve detection.
• Website cleanups:
  • Clean compromised websites, with a focus on WordPress and other common CMS platforms.
  • Remove malicious code, files and database injections without breaking site functionality.
  • Find the likely point of entry (vulnerable plugin, stolen credentials, outdated core) and recommend hardening steps.
• Incident response:
  • Respond to active security incidents: contain the threat, preserve evidence and restore a clean state.
  • Write clear incident summaries for partners and internal teams.
• Working with hosting partners:
  • Act as a technical point of contact for hosting partners on file reviews, detections and cleanup requests.
  • Explain findings in plain language and recommend next steps.
  • Help investigate possible false positives and report them for root cause analysis.
• SLA and escalation:
  • Work the alert and request queue so every item is acknowledged, updated and resolved within SLA.
  • Keep tickets accurate and up to date in our support tools.
  • Escalate to Tier 2 or Engineering with complete context when an issue is complex, widespread or product-related.
  • Take part in rotating daily assignments across research, partner support and cleanups.

Qualifications

• 1–2 years of experience in web security, malware analysis, incident response or a technical support role with a security focus.
• Hands-on experience identifying and removing malware from websites, especially WordPress.
• Experience troubleshooting and repairing broken WordPress sites (white screens, fatal errors, plugin and theme conflicts, database connection errors, broken updates).
• Comfort reading PHP and JavaScript, including obfuscated code.
• Working knowledge of Linux and the command line (grep, find, file permissions, log review).
• Understanding of how web servers, DNS and databases (MySQL/MariaDB) work.
• Familiarity with common web attack vectors: vulnerable plugins, file upload abuse, SQL injection, XSS and credential stuffing.
• Experience working a ticket queue against SLAs and knowing when to escalate.
• Fluent written and spoken English, for tickets, incident summaries, partner calls and team communication.

Nice to have

• Experience at a hosting company, web security vendor or managed WordPress provider.
• Experience with other CMS and e-commerce platforms, such as Magento, Joomla, Drupal, OpenCart and PrestaShop.
• Experience writing or tuning detection rules (YARA, regex signatures).
• Scripting in Bash or Python to automate analysis and cleanup tasks.
• Familiarity with cPanel, Plesk or other hosting control panels.
• Experience with support platforms such as Intercom, and with Slack-based customer channels.
• Spanish or Portuguese, to support partners across the Americas.
• Security certifications or coursework (Security+, GCIH, or similar).

What success looks like

• First 30 days: learn the Monarx platform, our tools and SOPs, and shadow each daily rotation.
• First 90 days: independently handle file reviews, cleanups and partner requests within SLA, with well-documented escalations.
• Ongoing: contribute new malware findings and process improvements that make detection and response faster.

Why join Monarx

• Your work protects sites at hosting-partner scale, not one server at a time.
• A decentralized, fully remote culture that trusts you to own your work, with a small, experienced team that shares knowledge daily.
• Exposure to fresh, real-world web malware every day.
• Clear growth path into Tier 2 Threat Research.