Senior Malware Reverse Engineer

IBM; Quezon City; On-site; PHP 900,000 - 1,500,000; Full time

Job summary

IBM is seeking a Malware Reverse Engineer to perform expert malware analysis, uncover complex techniques, and generate actionable threat intelligence for global clients.

You will collaborate with X-Force teams on incident response, develop threat models, and author robust automation scripts to enhance efficiency in malware analysis workflows.

Qualifications

• Advanced malware reverse engineering with unpacking of packed/obfuscated code.
• Deep knowledge of assembly for x86/x64/ARM architectures.
• Experience creating YARA rules, Snort/Suricata signatures and IOC generation.

Responsibilities

• Perform expert reverse engineering of malware across platforms and analyze C2 behavior, encryption, persistence, and exploits.
• Provide advanced threat research to support incident response and threat intelligence teams.
• Develop threat models and derive IOC indicators from artifacts and samples.
• Create automation scripts (primarily Python) to streamline unpacking, parsing, and analysis workflows.
• Collaborate with X-Force teams to deliver actionable insights during incidents.

Skills

Malware RE

Python

C/C++

Go

IDA Pro

Ghidra

x64dbg

WinDbg

Assembly

IOCs

Education

Master's Degree

Tools

IDA Pro

Ghidra

x64dbg

WinDbg

GDB

Job description

Introduction

In this role, you'll work in one of our IBM Consulting, where we deliver deep technical and industry expertise to a wide range of public and private sector clients around the world. The IBM X-Force Threat Intelligence (XFTI) team provides expert malware and threat analysis to customers globally. As a Malware Reverse Engineer, you will deliver cutting‑edge technical analysis and research, generating actionable threat intelligence to empower organizations against advanced and emerging cyber threats, significantly reducing their attack surface.

Introduction

In this role, you'll work in one of our IBM Consulting, where we deliver deep technical and industry expertise to a wide range of public and private sector clients around the world. The IBM X-Force Threat Intelligence (XFTI) team provides expert malware and threat analysis to customers globally. As a Malware Reverse Engineer, you will deliver cutting‑edge technical analysis and research, generating actionable threat intelligence to empower organizations against advanced and emerging cyber threats, significantly reducing their attack surface.

Your Role And Responsibilities

As a X-Force Malware Reverse Engineer, you will support advanced cyber threat analysis and incident response operations. In this role, you will perform deep technical research on malicious software, uncovering functionality and intent to strengthen detection and response capabilities. You will work closely with IBM X-Force Threat Intelligence and Incident Response teams to deliver high‑impact, actionable insights. Your primary responsibilities will include:

• Perform expert‑level reverse engineering of malware across multiple platforms, analyzing command‑and‑control behavior, communication protocols, encryption methods, persistence mechanisms, and exploit techniques.
• Provide advanced technical analysis and threat research to support X‑Force Threat Intelligence and Incident Response teams, contributing detailed insights during active cyber incidents.
• Develop comprehensive threat models by correlating malware findings with IBM’s proprietary telemetry, open‑source intelligence, and industry threat data. Derive and validate Indicators of Compromise (IOCs) from incident artifacts and malware samples.
• Support incident response efforts with timely, actionable intelligence and recommendations based on in‑depth malware and threat analysis.
• Create automation scripts, primarily in Python, to streamline malware unpacking, configuration extraction, data parsing, IOC generation, and overall analysis workflow efficiency.

Preferred Education

Master's Degree

Required Technical And Professional Expertise

• Advanced Malware Reverse Engineering: Experienced in malware reverse engineering and demonstrated expert‑level proficiency in advanced malware analysis techniques. This includes manual and automated unpacking of packed/obfuscated executable, rootkit analysis, dissecting complex exploit chains, bypassing sophisticated anti‑analysis/evasion mechanisms, and reconstructing malware logic from highly optimized assembly code.
• Programming & Scripting Expertise: Expertise in at least one high‑level programming language (e.g., Python, C, C++, Go) for developing analysis tools, automating tasks, scripting debuggers, and parsing complex data structures (e.g., malware configuration blocks, network protocols, cryptographic key values).
• Debugging & Disassembly Tools: Extensive hands‑on experience with industry‑standard debugging and disassembling tools (e.g., IDA Pro, Ghidra, x64dbg, WinDbg, GDB) for static and dynamic malware analysis, including advanced debugging techniques, scriptable breakpoints, and process injection/hooking.
• Assembly Language Proficiency: Deep, demonstrable expertise in assembly language (x86/x64/ARM/ARM64) and processor architectures, with the ability to swiftly comprehend low‑level code, decipher malware behavior, and identify vulnerabilities or exploit mechanisms.
• Signature Development: Proven ability to develop high‑fidelity signatures and rules for threat detection and research, including YARA rules, network‑based signatures (e.g., Snort/Suricata), and behavioral indicators, to effectively identify and track malware families and activities.

Preferred Technical And Professional Experience

• Malware Platform Breadth: Experience analyzing a wide range of malware file types, including Windows PE, ELF (Linux), MacOS binaries, and mobile platforms (Android/iOS).
• Forensic Artifact Analysis: Proficient in analyzing diverse forensic artifacts, including file system data, system logs, network packet captures, registry hives, and memory dumps, to reconstruct infection chains and and malware activity.
• Malicious Document Analysis: Experience with analyzing malicious documents (e.g., Office macros, PDF exploits) and understanding associated exploitation techniques.
• Operating System Internals: Deep working knowledge of various Operating Systems (Windows internals, macOS, Linux) and processor architectures (x86, x64, ARM, ARM64) relevant to malware execution.
• Threat Intelligence Collaboration: Experience supporting incident response partners, managed security, or threat intelligence teams, and clearly and concisely presenting complex malware analysis findings through high‑quality written reports and oral briefings for diverse technical and non-technical audiences.
• Automated Sandbox Familiarity: Familiarity with automated sandbox technologies for dynamic malware analysis (e.g., Cuckoo Sandbox, VMRay, Any.Run).