Parallel connects experienced cybersecurity specialists with projects supporting leading AI labs. We’re hiring a Windows Malware Researcher to help AI systems accurately distinguish between benign and malicious cybersecurity prompts.

You’ll apply deep expertise in Windows malware analysis, Windows internals, and reverse engineering to evaluate complex, ambiguous prompts. Your work will involve determining true user intent, assessing technical context, and providing clear annotations that improve model safety, training, and evaluation guidelines.

This is remote, project-based work. Engagements and hours vary with project demand, with scope and expected availability discussed before each assignment.

What you’ll do

• Review ambiguous cybersecurity prompts submitted to AI systems to determine the underlying intent and goal.
• Assess whether prompts reflect legitimate research and defensive purposes or malicious attack preparation.
• Apply deep domain expertise to evaluate the technical context, specificity, and real-world uplift a response would provide an attacker.
• Annotate prompts with accurate intent labels and clear, concise written rationales.
• Collaborate with other researchers through independent dual-annotation, escalating disagreements to a reviewer.
• Identify and flag emerging attack techniques, edge cases, and gaps in current project guidelines to improve the evaluation process.

What you’ll bring

• At least five years of hands-on experience in Windows malware analysis and research.
• Strong command of Windows internals and the Win32/NT API, including process injection, persistence, privilege escalation, and EDR/AV evasion techniques.
• Demonstrated experience in static and dynamic analysis of PE files, including unpacking, deobfuscation, and debugger use (x64dbg, IDA, Ghidra).
• Experience analyzing major malware families such as loaders, infostealers, RATs, ransomware, and C2 frameworks.
• Ability to write YARA rules and extract IOCs and TTPs mapped to the MITRE ATT&CK framework.
• Strong analytical judgment and clear written communication in English to concisely document reasoning.
• Ability to work independently, manage details effectively, and solve complex, ambiguous problems.

Preferred experience

• Advanced certifications such as GIAC GREM, eCMAP, or GIAC GCFA.
• Demonstrated online achievements, published security research, or technical write-ups.
• Contributions on platforms like HackTheBox, Bug Bounty programs, or similar security communities.

Selection process

Applicants must pass an assessment and complete a background check before engagement. Final compensation within the posted range will reflect relevant experience and demonstrated technical ability.