Principal Threat Detection Research Engineer (Remote)

As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn’t changed — we’re here to stop breaches, and we’ve redefined modern security with the world’s most advanced AI-native platform. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward. We’re also a mission-driven company. We cultivate a culture that gives every CrowdStriker both the flexibility and autonomy to own their careers. We’re always looking to add talented CrowdStrikers to the team who have limitless passion, a relentless focus on innovation and a fanatical commitment to our customers, our community and each other. Ready to join a mission that matters? The future of cybersecurity starts with you.

About the Team
The CrowdStrike Malware Research Center is the core of Falcon’s malware detection and response capabilities. The team has a focus on understanding the threat landscape and sets the target for what Falcon should be identifying and preventing. Additionally, the MRC is responsible for understanding our capabilities, and mapping how well our machine learning and behavioral protection capabilities are doing against those threats. Where there is a gap, the MRC takes action
to improve our detection stance and overall protection story. MRC also performs pathfinding research to enable technology development using innovation, prototyping, and bleeding-edge machine learning to support our flagship Falcon product. The MRC works across many parts of CrowdStrike to ensure we're on target and delivering the best protection against the current threat landscape.

About the Role:
Leading the charge for understanding malware activity today is the Threat Research team. With a focus on malware research, the primary goal is to investigate relevant threats and techniques impacting our customers. Given the enormous volume of malware, this role requires a scalable approach via automation and machine learning, empowering researchers to extract insights while
systems handle volume.
 

Research Engineers will validate threats from a range of sources, using techniques such as execution, behavioral review, and reverse engineering to determine their potential impact. Key responsibilities include communicating technical details to cross-functional teams, recommending effective mitigations, and enabling Falcon’s defenses.
 

Reverse engineering of malware and exploits is a part of the role—uncovering underlying mechanisms, algorithms, and tactics used by adversaries. This insight feeds into internal tools and response strategies. Researchers also contribute to automation strategy by identifying where efficiencies can be gained and providing proof-of-concept tooling to enhance detection and mitigation workflows. Staying current with industry advancements and integrating new methods into the team’s
operations are key to maintaining cutting-edge protection.
 

What You'll Do:

• Analyze and validate malware threats using behavioral analysis, execution, and reverse engineering.

• Communicate technical threat details and mitigation strategies to response and engineering teams.

• Collaborate to prioritize and define automation opportunities to streamline threat analysis workflows.

• Perform reverse engineering of malware and exploits to identify TTPs and support mitigation planning.

• Contribute proof-of-concept automation and tooling to demonstrate new ideas and accelerate analysis.

• Continuously research and integrate new threat detection and analysis techniques.

• Provide actionable intelligence to improve Falcon’s defense capabilities.

What You'll Need:

• 8+ years’ experience in threat research, with a focus on malware analysis and cloud threat actor tradecraft.

• Experience in reverse engineering, disassembly, and analyzing file-based threats and exploits.

• Experience with AWS tradecraft, IaaS, IaC, and threat actor use of cloud IAM.

• Strong understanding of OS internals and behavior-based detection