Windows Malware Researcher

Bezel; United States; Remote; USD 83,000 - 165,000; Part time

Job summary

Parallel is hiring a Windows Malware Researcher to help AI systems distinguish benign prompts from malicious ones. You'll apply deep expertise in Windows malware analysis, Windows internals, and reverse engineering to evaluate complex prompts and improve model safety and evaluation guidelines.

This is a remote, project-based role with variable hours; engagements and scope are discussed before each assignment.

Qualifications

• At least five years of hands-on Windows malware analysis and research.
• Strong command of Windows internals and the Win32/NT API, including process injection, persistence, privilege escalation, and EDR/AV evasion techniques.
• Demonstrated experience in static and dynamic analysis of PE files, including unpacking, deobfuscation, and debugger use (x64dbg, IDA, Ghidra).
• Experience analyzing major malware families such as loaders, infostealers, RATs, ransomware, and C2 frameworks.
• Ability to write YARA rules and extract IOCs and TTPs mapped to the MITRE ATT&CK framework.
• Strong analytical judgment and clear written communication in English to concisely document reasoning.
• Ability to work independently, manage details effectively, and solve complex, ambiguous problems.

Responsibilities

• Review ambiguous cybersecurity prompts submitted to AI systems to determine the underlying intent and goal.
• Assess whether prompts reflect legitimate research and defensive purposes or malicious attack preparation.
• Apply deep domain expertise to evaluate the technical context, specificity, and real-world uplift a response would provide an attacker.
• Annotate prompts with accurate intent labels and clear, concise written rationales.
• Collaborate with other researchers through independent dual-annotation, escalating disagreements to a reviewer.
• Identify and flag emerging attack techniques, edge cases, and gaps in current project guidelines to improve the evaluation process.

Skills

Windows malware analysis

Windows internals

Win32/NT API

Process injection

Persistence techniques

EDR/AV evasion

PE analysis

Unpacking

Deobfuscation

Debugger (x64dbg/IDA/Ghidra)

YARA rule writing

IOC extraction

MITRE ATT&CK mapping

English writing

Independent work

Tools

x64dbg

IDA

Ghidra

Job description

Contract Role

Work with a team on an agreed project or for a set period. Agree on the scope, schedule and payment terms before you start.

Parallel connects experienced cybersecurity specialists with projects supporting leading AI labs. We’re hiring a Windows Malware Researcher to help AI systems accurately distinguish between benign and malicious cybersecurity prompts.

You’ll apply deep expertise in Windows malware analysis, Windows internals, and reverse engineering to evaluate complex, ambiguous prompts. Your work will involve determining true user intent, assessing technical context, and providing clear annotations that improve model safety, training, and evaluation guidelines.

This is remote, project-based work. Engagements and hours vary with project demand, with scope and expected availability discussed before each assignment.

What you’ll do

• Review ambiguous cybersecurity prompts submitted to AI systems to determine the underlying intent and goal.
• Assess whether prompts reflect legitimate research and defensive purposes or malicious attack preparation.
• Apply deep domain expertise to evaluate the technical context, specificity, and real-world uplift a response would provide an attacker.
• Annotate prompts with accurate intent labels and clear, concise written rationales.
• Collaborate with other researchers through independent dual-annotation, escalating disagreements to a reviewer.
• Identify and flag emerging attack techniques, edge cases, and gaps in current project guidelines to improve the evaluation process.

What you’ll bring

• At least five years of hands-on experience in Windows malware analysis and research.
• Strong command of Windows internals and the Win32/NT API, including process injection, persistence, privilege escalation, and EDR/AV evasion techniques.
• Demonstrated experience in static and dynamic analysis of PE files, including unpacking, deobfuscation, and debugger use (x64dbg, IDA, Ghidra).
• Experience analyzing major malware families such as loaders, infostealers, RATs, ransomware, and C2 frameworks.
• Ability to write YARA rules and extract IOCs and TTPs mapped to the MITRE ATT&CK framework.
• Strong analytical judgment and clear written communication in English to concisely document reasoning.
• Ability to work independently, manage details effectively, and solve complex, ambiguous problems.

Preferred experience

• Advanced certifications such as GIAC GREM, eCMAP, or GIAC GCFA.
• Demonstrated online achievements, published security research, or technical write-ups.
• Contributions on platforms like HackTheBox, Bug Bounty programs, or similar security communities.

Selection process

Applicants must pass an assessment and complete a background check before engagement. Final compensation within the posted range will reflect relevant experience and demonstrated technical ability.

Publish Date

Oct 22, 2026

Project duration

Oct 26, 2026 – Ongoing

Location

Remote

What Parallel does

Work shapes identity, purpose, and possibility. We exist to help people everywhere discover their life’s work, and to help organizations realize their mission by connecting with the people destined to build it.

Mission

Our mission is to help people find their life's work.