Principal Reverse Engineer (Malware, Unit 42)

Our Mission

At Palo Alto Networks® everything starts and ends with our mission:

Being the cybersecurity partner of choice, protecting our digital way of life.
Our vision is a world where each day is safer and more secure than the one before. We are a company built on the foundation of challenging and disrupting the way things are done, and we're looking for innovators who are as committed to shaping the future of cybersecurity as we are.

Who We Are

This role is remote, but distance is no barrier to impact. Our hybrid teams collaborate across geographies to solve big problems, stay close to our customers, and grow together. You will be part of a culture that values trust, accountability, and shared success where your work truly matters.

We have the vision of a world where each day is safer and more secure than the one before. These aren't easy goals to accomplish - but we're not here for easy. We're here for better. We are a company built on the foundation of challenging and disrupting the way things are done, and we're looking for innovators who are as committed to shaping the future of cybersecurity as we are.

• The Unit 42 Malware team is a global team responsible for providing accurate malware analysis, threat hunting capabilities, and the development of malware automation pipelines. This role is designed for an experienced Reverse Engineer with familiarity specifically supporting consulting operations and threat intelligence. The role has flexible hours, but will have an on-call component that includes a commitment to shared coverage of high-priority tickets that may arrive between Friday through Sunday.

• Advanced knowledge with at least one disassembler (e.g. IDA Pro, Ghidra, Binary Ninja).
• Expertise with user-mode and kernel-mode debuggers (e.g. x64dbg, WinDbg, gdb).
• Developing and scaling reverse engineering automations (e.g. IDAPython, Ghidra Python, Docker).
• Deep understanding of modern malware techniques, including obfuscation and evasion tactics.
• Understanding of x86/x64 architecture and IL formats (e.g. .NET).
• Proficiency in at least one programming language (e.g. Python, C, C++).
• Knowledge of networking protocols (e.g. HTTP, DNS, TCP/IP) and analyzing traffic.
• Experience configuring sandboxes to increase hit-rate and accelerate analysis.
• Familiarity with prompt engineering and using LLMs to accelerate analysis.
• Advanced understanding of modern Windows internals relevant to malware analysis.
• Experience transforming/modifying malware to support analysis (e.g. deobfuscation).
• Familiarity with script deobfuscation and analysis (e.g. PowerShell, JavaScript)

• Proven track record of contributing to threat research initiatives
• Designing and building next-generation hunt tooling

• Hands-on experience with real-world malware and threats.
• Access to industry-leading tools and infrastructure.
• Opportunity to work on impactful projects that contribute to threat intelligence.
• A collaborative and supportive team environment.