Job Description

SUMMARY

The Senior Threat Research Consultant contributes to Arete’s cyber threat research program by focusing on cybercrime activity, analyzing cyber threats, and uncovering emerging threats. The role involves malware reverse engineering, adversary tracking, threat detection through deep technical analysis and intelligence gathering, and development and innovation. The consultant contributes to the research and publication of threat insights, internal work products, and tailored intelligence products for Arete’s clients and advances Arete’s detection and response capabilities.

ROLES & RESPONSIBILITIES

· Collaborate with the Threat Research team (TRT) Director to design and implement custom tools and automation pipelines to enhance malware analysis, threat detection, and threat hunting capabilities

· Performs static and dynamic malware reverse engineering and classifies malware families to uncover novel threats

· Evaluates and integrates security technologies such as sandboxing solutions, multi-antivirus scanners, and artificial intelligence (AI) tools to improve TRT capabilities

· Develops methodologies to classify and correlate malware samples into malware families using static, dynamic, behavioral, and intelligence-based analysis

· Develops threat detection tools, mechanisms, and methods to support proactive threat hunting and incident response activities

· Conducts threat hunting in endpoint detection and response (EDR) telemetry data to identify hidden threats

· Analyzes internal case reports, raw data, and open-source intelligence to identify emerging cyber threats, trends, and threat actor groups

· Identifies and reports on tactics, techniques, and procedures (TTPs) used by cyber threat actors to support detection and mitigation strategies

· Creates finished intelligence reports, blog posts, and industry insights for internal and external clients to position Arete as a cyber threat intelligence thought leader

· Informs internal teams about new threat actor TTPs to strengthen defense and response strategies.

· Uncovers adversary activity that is not detected by existing rules to improve detection coverage

· Identifies intelligence and technology gaps and submits requests to address them

· Responds to information requests from clients and internal stakeholders to support decision making

· Prepares internal presentations to communicate analytical findings and technical insights

· As needed, conducts client briefings through calls, video conferences, webcasts, in-person sessions, or at industry conferences

· Provides tactical intelligence and analytical support to Cyber Threat Intelligence (CTI), Digital Forensics and Incident Response (DFIR), Security Operations Center (SOC), and Managed Detection and Response (MDR) teams

· Creates detailed process documentation to standardize workflows and enhance knowledge transfer

· Acts as a liaison between the Threat Research Team and internal teams such as Threat Intel, SOC, Incident Response, Managed Security Services, Cyber Product Development, Engineering, and IT

· Fosters a culture of continuous learning, collaboration and innovation across the team and broader organization

· May perform other duties as assigned by management

SKILLS AND KNOWLEDGE

• Ability to work effectively in fast-paced, high-volume, and results-driven environments while managing multiple priorities
• Ability to produce high-quality finished intelligence products within tight deadlines
• In-depth knowledge of malicious code, behavior, and use in cybercrime operations
• Understanding of tools and techniques used in cybercrime operations
• Familiarity with cyber threat intelligence frameworks such as MITRE ATT&CK and Diamond Model
• Experience working in fast-paced environments alongside Digital Forensics and Incident Responders
• Knowledge of:
• various malware types, including crimeware, ransomware, bots, commodity malware, and nation-state cyber threats
• ransomware decryptors
• vulnerability exploitation techniques and detection methods
• widely used open-source malware analysis tools
• sandbox environments and dynamic analysis systems
• network traffic analysis
• memory forensics and memory analysis techniques
• log analysis methods across diverse sources
• Proficiency in writing and interpreting regular expressions
• Ability to reverse engineer diverse malware types, including
• Go, Rust, C/C++, .NET, Visual Basic scripts, Java scripts, PowerShell scripts
• Malicious documents
• Webshells
• Shellcode
• Packed and obfuscated code
• Experience using disassemblers and debuggers
• Experience in anti-analysis techniques and patching code to bypass checks
• Proficiency in working with encoding and encryption algorithms
• Ability to write decoding and decryption routines to extract indicators and payloads
• Experience developing YARA rules for malware detection and classification
• Experience writing custom endpoint detection and response (XEDR) threat detection mechanisms for platforms such as SentinelOne or CrowdStrike
• Experience working with Threat Intelligence Platforms (TIPs) such as ThreatConnect.

JOB REQUIREMENTS

• Master’s degree in Cybersecurity, Engineering, Computer Science, Information Assurance, or related field with a minimum of 6 years of experience related to the job role. or a Bachelor’s degree with a minimum of 8 years of experience related to the job role.
• 8+ years focused on any combination of the following: malware reverse engineering, anti-analysis techniques, encryption/decryption algorithms, disassemblers/debuggers, patching/exploiting code, detection engineering.
• Experience:
• Using disassemblers and debuggers
• Performing analysis of ransomware and malware associated with extortion threat actor groups and identifying key indicators of malicious activity.
• Profiling threats, preferably cybercrime threats like ransomware and ransomware precursors.
• With EDR technology, threat hunting, automated malware analysis sandbox systems, and countermeasure development (e.g., SentinelOne S1QL, CrowdStrike CQL, Microsoft Defender XDR Kusto, Sigma).
• With automated malware analysis sandbox systems
• Developing, testing, and maintaining Yara rules
• Ability to offer after-hours support during critical engagements.

DISCLAIMER

The above statements are intended to describe the general nature and level of work being performed. They are not intended to be an exhaustive list of all responsibilities, duties, and skills required by personnel so classified.

WORK ENVIRONMENT

While performing the responsibilities of this position, the work environment characteristics listed below are representative of the environment the employee will encounter: Usual office working conditions. Reasonable accommodations may be made to enable people with disabilities to perform the essential functions of this job.

TERMS OF EMPLOYMENT

Salary and benefits shall be paid consistent with Arete's salary and benefit policy.

DECLARATION

The Arete Incident Response Human Resources Department retains the sole right and discretion to make changes to this job description.

EQUAL EMPLOYMENT OPPORTUNITY

We are proud to be an equal opportunity employer- and celebrate our employees’ differences, regardless of race, colour, religion, sex, sexual orientation, gender identity, national origin, age, disability, or Veteran status. Different makes us better.

Arete Incident Response is an outstanding (and growing) company with a very dedicated, fun team. We offer competitive salaries, fully paid benefits including Medical/Dental, Life/Disability Insurance, 401(k) and the opportunity to work with some of the latest and greatest in the fast-growing cyber security industry.

When you join Arete…

You’ll be doing work that matters alongside other talented people, transforming the way people, businesses, and things connect with each other. Of course, we will offer you great pay and benefits, but we’re about more than that. Arete is a place where you can craft your own path to greatness. Whether you think in code, words, pictures or numbers, find your future at Arete, where experience matters.

Equal Employment Opportunity

We’re proud to be an equal opportunity employer- and celebrate our employees’ differences, regardless of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, or Veteran status. Different makes us better.