At MITRE, your passion fuels work that impacts our nation and improves lives. This is where your skills strengthen national security, cybersecurity, health, transportation, and citizen services. We’re a nonprofit engineering, applied research, and advanced technology organization working in the public interest. With objectivity and integrity at our core, we lead federally funded research and development centers for U.S. government agencies – collaborating with industry and academia to deliver integrated, high-impact solutions that advance our nation’s health, security, and prosperity. Our people tackle the toughest technical challenges, supported by competitive benefits, meaningful career development, and a culture of innovation, collaboration, and technical excellence. Choose MITRE for a career with purpose — and help shape the future.

Department Summary

The Digital Investigations Department focuses on transforming digital data into actionable understanding for investigative and law enforcement purposes. We combine technical analysis, investigative tradecraft, data analytics, and mission context to answer difficult questions, reconstruct events, identify malicious activity, reveal relationships, and support operational decision-making.

Our staff work across a range of digital investigation specialties, including digital evidence and forensics, open-source and digital intelligence, investigative analytics, adversary and activity analysis, operational investigations, and the development of new investigative capabilities and tradecraft.

Roles & Responsibilities

In this role, the selected candidate will serve as an onsite technical liaison between MITRE and a federal law enforcement sponsor, providing hands-on expertise in malware analysis, reverse engineering, and cyber investigations. The candidate will work closely with sponsor personnel to understand operational challenges, deliver actionable technical insights, identify capability gaps, and connect sponsor needs with MITRE's broader technical expertise and research capabilities.

The selected candidate may contribute to efforts that:

Perform Malware Analysis and Reverse Engineering: Conduct static and dynamic analysis of malicious software, including compiled binaries, scripts, and other executable artifacts, to understand functionality, identify malicious behaviors, extract indicators, and assess potential relationships to known malware families or campaigns.
Analyze Executables and Malicious Code: Examine executable file formats, assembly instructions, memory structures, operating system interactions, obfuscation techniques, packing methods, and other low-level software characteristics to understand how malicious code operates and identify artifacts relevant to investigations.
Develop and Apply Malware Analysis Techniques: Use debuggers, disassemblers, decompilers, sandboxes, and other specialized tools to investigate malware samples, overcome analysis challenges, and develop repeatable approaches for examining complex or unfamiliar malicious software.
Support Cyber and Law Enforcement Investigations: Provide technical analysis in support of cybercrime and other investigative missions, including identifying relationships among malware samples, digital artifacts, network infrastructure, and adversary activity. Apply investigative awareness to produce findings that can support operational decisions and investigative leads.
Conduct Digital Forensic and Artifact Analysis: Examine relevant host, network, memory, and filesystem artifacts to reconstruct malicious activity, understand execution and persistence mechanisms, and identify evidence or indicators that may support ongoing investigations.
Apply Deep Technical Knowledge of Computing Systems: Leverage an understanding of operating systems, executable formats, filesystems, networking protocols, and software execution to investigate malicious activity and explain complex technical behaviors.
Develop and Evaluate Technical Capabilities: Research, prototype, test, and assess malware analysis tools, reverse engineering techniques, automation, and emerging technologies to address sponsor challenges and improve investigative effectiveness.
Serve as an Onsite Technical Liaison: Work directly with sponsor personnel to understand mission priorities, respond to emerging technical needs, provide timely analytical support, and facilitate collaboration between the sponsor and MITRE technical teams. Build trusted working relationships while identifying opportunities to bring additional MITRE expertise and capabilities to bear on sponsor problems.
Communicate Technical Findings and Recommendations: Translate complex malware analysis and reverse engineering findings into clear, actionable technical reports, briefings, and recommendations tailored to investigators, technical specialists, operational personnel, and leadership.
Collaborate and Share Technical Expertise: Work across multidisciplinary teams of investigators, reverse engineers, cybersecurity specialists, software developers, and researchers. Share knowledge, mentor colleagues, and contribute to the development of technical tradecraft and investigative capabilities.
Research Emerging Threats and Technical Challenges: Investigate evolving malware techniques, adversary capabilities, exploitation methods, and emerging technologies. Develop hypotheses, conduct technical experimentation, and identify innovative approaches to solving difficult cyber investigative problems.

Basic Qualifications

Typically requires a minimum of 8 years of related experience with a Bachelor’s degree; or 6 years and a Master’s degree; or a PhD with 3 years’ experience; or equivalent combination of related education and work experience
Experience performing static and dynamic malware analysis and reverse engineering of compiled software to understand functionality, identify malicious behaviors, and extract relevant technical artifacts.
Experience using reverse engineering and malware analysis tools such as IDA Pro, Ghidra, x64dbg, WinDbg, Binary Ninja, or comparable tools.
Working knowledge of assembly language, particularly x86/x64, and experience with programming or scripting languages such as C, C++, Python, or similar.
Strong understanding of operating system fundamentals, including process execution, memory management, executable loading, and interactions between software and the operating system.
Knowledge of executable file formats, particularly Portable Executable (PE) files, and their underlying structures.
Understanding of networking protocols, filesystem structures, and core computing concepts relevant to malware behavior and technical investigations.
Experience analyzing malicious software to identify functionality, indicators of compromise, and artifacts that may support additional technical analysis or investigative leads.
Ability to independently research unfamiliar technologies, troubleshoot complex technical challenges, and develop analytical approaches to solve problems.
Strong written and verbal communication skills, including the ability to explain complex technical findings to both technical and non-technical audiences.
Ability to work independently in an onsite, sponsor-facing environment, collaborate with multidisciplinary teams, and establish effective working relationships with sponsor personnel.
Must have an active Top Secret/SCI U.S Government issued Security Clearance and must be eligible to obtain and maintain a Top Secret/SCI with polygraph U.S Government issued Security Clearance. Per the U.S. Government’s eligibility requirements, you must be a U.S Citizen to be considered for a security clearance.
This position has an on-site requirement of 5 days a week on-site.

Preferred Qualifications

Advanced experience reverse engineering complex malware, including packed, obfuscated, or otherwise protected binaries, and identifying techniques used to evade detection or analysis.
Experience with debugging, disassembly, decompilation, memory analysis, and manual unpacking techniques.
Experience identifying relationships among malware samples, attributing samples to known malware families, and applying code similarity, fuzzy hashing, or other comparative analysis techniques.
In-depth knowledge of Windows internals, including the Windows API, registry, process and thread structures, memory allocation, persistence mechanisms, and executable loading.
Experience conducting digital forensic analysis of host, memory, filesystem, or network artifacts to reconstruct malicious activity and support technical investigations.
Experience supporting federal law enforcement, criminal investigations, or other investigative missions, including familiarity with investigative workflows, evidentiary considerations, and operational requirements.
Experience translating malware analysis and reverse engineering findings into actionable investigative leads, technical assessments, or operational recommendations.
Experience developing scripts, automation, custom analysis tools, or other technical capabilities to improve malware analysis and investigative workflows.
Experience evaluating emerging malware analysis technologies, reverse engineering tools, or analytical approaches to address operational capability gaps.
Experience working directly with government sponsors or mission stakeholders to understand requirements, identify technical challenges, and coordinate solutions across organizational boundaries.
Demonstrated ability to build trusted sponsor relationships, identify opportunities for technical innovation, and connect operational needs with broader organizational expertise.
Experience mentoring technical staff, sharing specialized knowledge, or developing technical documentation and training materials to improve team capabilities.

This requisition requires the candidate to have a minimum of the following clearance(s):

Top Secret/SCI

This requisition requires the hired candidate to have or obtain, within one year from the date of hire, the following clearance(s):

Top Secret/SCI/Polygraph

Salary compensation range and midpoint

$158,800 - $198,500 - $238,200 Annual

Work Location Type

Onsite

Commitment to Non-Discrimination

All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local or international law.

MITRE intends to maintain a website that is fully accessible to all individuals. If you are unable to search or apply for jobs and would like to request a reasonable accommodation for any part of MITRE’s employment process, please email [email protected] for general support and [email protected] for intern positions. This service is for individuals requiring reasonable accommodation requests. Please note that vendor solicitations will not receive a reply.

Benefits information may be found here.

Cyber Investigations Engineer – Malware Analysis & Reverse Engineering @ MITRE

About this role