Security Analyst for Infected Websites (Contract)

Defiant, makers of Wordfence, is a small, dynamic, fast-growing, and profitable company with loyal customers who love our products and services. We are the global leader in WordPress security, protecting over 5 million websites.

We're seeking a Security Analyst to work on an hourly contract basis from your home office, with 100% availability during that time.

The following shifts are available:

• Weekdays: Monday-Friday, 9:00 AM - 5:00 PM ET (40 hrs/wk)
• Weekends: Saturday-Sunday, 11:00 AM - 7:00 PM ET (16 hrs/wk)

Candidates in regions where these hours strongly align with their normal business hours are encouraged to apply. You do not have to be based in the USA.

The contract rate for this role is $35+ USD per hour, depending on experience.

Company Culture

You'll work with a talented and motivated team that is friendly, fast-moving, self-managing, and highly capable with a sense of humor. Our team's family time is important; we won't typically require long hours when we can avoid it, which is almost always. Our entire team works remotely using Slack for casual interaction. There's no micro-­management here—we trust that you will see tasks through to completion and communicate with your fellow team members or ask for help when needed.

At Defiant, ‘trust’ is the attribute we value most highly among our team members. We need to know that you can grab a task, communicate clearly with stakeholders, and see the task to completion with superb attention to detail.

We use apps like Slack, GitHub, and Google Apps for our workflow.

Job Description

We are looking for Security Analysts to join our Care and Response Team. You will assist our customers and investigate site intrusions, as well as repair their sites and remove all traces of compromise.

Additionally, you will collect and process evidence from intrusions that will help improve our threat detection. You will need to determine how the intrusion occurred, collect all IOCs (indicators of compromise), and work with our Threat Intelligence team on vulnerability research and malware signature development.

In your downtime, you will triage and validate vulnerability reports submitted through our Bug Bounty Program. You’ll assess impact to prioritize submissions, reproduce and analyze vulnerabilities in controlled environments, and identify root causes in source code. You will document findings, recommend fixes or custom firewall rules, and propose bounty amounts based on severity and impact.

You will collaborate with developers, customer support, and disclosure teams, as well as validate that patches are sufficient once released.

General requirements:

• Highly technical and comfortable with a wide range of open source tools such as grep, find, etc.
• Excellent written and verbal communication skills.
• Ability to interact with customers professionally.
• Work well in a team and work independently without additional guidance.
• Excellent analytical ability, ability to think outside of the box, and an eagerness to learn.
• Must have attention to detail.

Requirements

The specific skills we require for this position are:

• 3+ years of experience with WordPress required.
• Technical experience with common web application based vulnerabilities in WordPress plugins and themes. 
• A solid understanding of WordPress hooks, how they are used, and how they can lead to vulnerabilities.
• Experience with administering multiple Linux stacks. (We don’t support Windows.)
• Experience with MySQL.
• 2+ years of experience conducting remediation of compromised websites, including analysis of how the intrusion occurred, removing the intrusion vector, and restoring the site to a fully functional state.
• Experience in vulnerability research is a plus, which includes:
• Ability to develop proof of concepts programmatically or conceptually to test the exploitability of vulnerabilities, and the general ability to read/understand programmatic and conceptual proof of concepts.
• Ability to replicate the exploitability of vulnerabilities in a test environment. 
• Ability to review source code changes to determine if a vulnerability was patched and what the patch was for.
• Experience generating/modifying HTTP requests.
• Experience working with BURP suite or similar proxy software and a PHP debugger.
• A solid understanding of regular expressions. Must be able to write expressions on the fly to match and remove only malicious code (often polymorphic) without affecting any legitimate code and to write malware signatures for our products.
• Ability to write and read P