Senior Detection Engineer

What does Spamhaus do?

Spamhaus, together with its partner abuse.ch, strengthens trust and safety for the Internet. We extract intelligence from globally sourced signals that enable us to provide the community and clients with actionable and timely datasets to provide protection, insight and context to behaviour relating to internet resources.

As the market leader in email blocklists (DNSBLs) for the past two decades, we are moving into the broader cyber threat intelligence market to leverage the breadth of signals and actionable intelligence we have on Internet activity.

Why work for Spamhaus?

We hire people who are passionate about our purpose and want to work in an organization where they will be stretched and have the opportunity to question and challenge.

Self-motivated individuals looking for a non-corporate environment will enjoy our culture. We have a start-up mentality: we are extremely hardworking, ideas are welcome, and team members are expected to “get stuck in.” Our teams’ efforts make a difference, and their work really does "move the needle". 

Established over 25 years ago (the same year as Google), Spamhaus is still 100% owned by its founder; we bring experience, expertise, and stability in a fluid marketplace.

The Team: 

The Cyber Threat Intelligence Focus Unit (CTI FU) team members are located across Europe and work closely with our partner abuse.ch. The team is a small group of developers, product specialists and malware researchers, and this role is a key addition to it.

The team focuses on malware research and building features and functionality for our Cyber Threat Intelligence offering, the CTI Hunting Platform. This role may be required to work with and supervise interns and other more junior team members. We value strong communication and a fail-fast approach. If you enjoy collaborating openly, sharing your work regularly, and being part of a close-knit and supportive team, you’ll feel at home here.

Key responsibilities will include:

• Write, test, and maintain high-fidelity detection rules (such as YARA) with low false-positive rates, optimized for scalable deployment across continuous detection and retrohunt pipelines.
• Own the quality of detection rule sets, including rule verification, false-positive risk assessment and performance testing.
• Reverse engineer Windows and Linux malware, including emerging families, packers and obfuscated payloads, andto understand their behaviour, uncover configuration structures and identify opportunities for detection and intelligence extraction.
• Develop, maintain malware configuration extractors and parsers to automatically recover command-and-control (C2) infrastructure, campaign identifiers, and other relevant intelligence from files.
• Work with the developers to support our in-house sandbox with better detection capabilities, and ensure proper output when detonating modern threats.

• Supervise and review the work of any interns or other junior team members, setting their priorities and giving regular feedback.
• Where appropriate, share findings with the wider security community, working with marketing to produce content and present at appropriate events.
  

Required Experience & Skills

• 5+ years of professional experience in Malware Analysis, Reverse Engineering or Detection Engineering.
• Expert-level experience writing detections using proven tools such as YARA and Suricata, including performance tuning, false-positive management and testing against large sample sets.
• Proven ability to build your own malware configuration extractors (for example, in Python), including handling common encryption and obfuscation schemes.
• Hands-on experience with malware sandboxes, such as CAPE, and an understanding of how sandbox output feeds detection and extraction workflows.
• Strong reverse engineering skills using disassemblers, decompilers and debuggers, and knowledge of packers and common obfuscation methods.
• Knowledge of Windows and Linux OS internals and of the network protocols commonly used by malware families.
• Proficiency in Python, plus familiarity with Assembly (x86/x64), C and at least one of Go or Rust.
• The ability to set your own research priorities, recommend direction based on client and product focus, and guide a less experienced colleague.
• Strong written and verbal communication in English, including explaining technical findings to developers and non-technical colleagues.
  

Preferred / Nice-to-Have

• Experience with sandbox development or sandbox internals in general, including hardening and anti-evasion techniques. Drakvuf experience would be ideal, but is not critical.
• Experience with sandbox environment hardening and anti-evasion techniques.
• Familiarity with large-scale YARA scanning and retrohunt platforms such as VirusTotal and Censys
• A public track record of research, rules, or tooling (for example, conference talks, blogs, or open-source contributions).

Benefits:

• Competitive salary.
• Excellent annual leave allowance.
• Opportunity to work in a dynamic and supportive environment.
• Flexible working hours and remote work setup.

Location:
European-based. Everyone at Spamhaus works from home; however, global travel is required approximately three times a year for face-to-face meetings and event attendance. 

Contract:

Permanent.