Security Engineer, Malware Hunting

Facebook's mission is to give people the power to build community and bring the world closer together. Through our family of apps and services, we're building a different kind of company that connects billions of people around the world, gives them ways to share what matters most to them, and helps bring people closer together. Whether we're creating new products or helping a small business expand its reach, people at Facebook are builders at heart. Our global teams are constantly iterating, solving problems, and working together to empower people around the world to build community and connect in meaningful ways. Together, we can help people build stronger communities - we're just getting started. Facebook's Malware Discovery team is looking for a Security Engineer with experience in investigating cyber threats, analyzing data to detect malware patterns and applying an adversarial mindset. The team investigates and measures the prevalence of abuse attributable to malicious software and its impact to Facebook or its community of users. They provide actionable insights and collaborate with other teams to implement scalable and durable solutions. The ideal candidate will have a background in hunting cyber threats, red/purple teaming and large scale data analysis. We are looking for someone who is a self-starter, result-driven, excellent at collaboration and passionate about finding threats or abuse. <ul><li>Actively engage with cross-functional partners across Facebook to understand their domains and determine how they are affected by malware.</li><li>Proactively uncover, investigate and track new malware related threat vectors across Facebook.</li><li>Effectively communicate findings on the severity, prevalence, or absence of malware in a space.</li><li>Create and collaborate on tools and detections to discover or classify unknown malware.</li><li>Determine if malware is the source of abusive or anomalous activity detected by other teams.</li><li>Triage large volumes of files to extract signals for further investigation/discovery.</li></ul> <ul><li>Basic malware triage skills, such as using static and dynamic analysis tool</li><li>Experience creating host or network based signatures (Yara, ClamAV, Suricata)</li><li>Interest in exploring both traditional and nontraditional domains typically affected by malware</li><li>Experience handling large amounts of data including scripting, data analysis, and presenting data in digest-able ways</li><li>Experience with cross functional collaboration and experience communicating malware jargon in laymen terms, and engage in technical security discussions</li><li>BA/BS in Computer Science, Data Science, or 2+ years similar work experience</li><li>Experience in at least one scripting language such as PHP, Python, C++, or Java</li><li>Experience with at least one SQL-like language</li></ul> <ul><li>Basic understanding of analysis on documents (DOC, PDF) and executables (APK, iOS, PE, ELF, MACHO)</li><li>Knowledge in system internals for one or more of: Windows, macOS, Android, Linux, or iOS</li><li>Knowledge with machine code in one or more architectures (x86, x64, ARM, MIPS, other)</li><li>Knowledge with analyzing and decoding network traffic</li><li>Experience with campaign tracking</li><li>Experience with red team or purple team</li></ul> Facebook is proud to be an Equal Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender, gender identity, gender expression, transgender status, sexual stereotypes, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics. We also consider qualified applicants with criminal histories, consistent with applicable federal, state and local law.Facebook is committed to providing reasonable accommodations for candidates with disabilities in our recruiting process. If you need any assistance or accommodations due to a disability, please let us know at accommodations-ext@fb.com.