Malware analysis is one of the most skilled defensive specialisms, and one of the hardest to break into, because few organisations hire juniors directly into it. Most malware analysts arrive from a SOC, incident response or software development, having built reverse engineering skills on their own time first. This guide explains what the role involves day to day, the skills and tools that matter, realistic routes in, the certifications that help, and where the role leads. It is written for SOC analysts, incident responders, developers and students who want a clear, honest plan rather than a list of courses.
Key takeaways
- The output is defence, not curiosity. A malware analyst's job is to turn a sample into indicators, detections, scoping questions and remediation advice that someone else can act on within hours.
- Triage first, reverse engineering when it pays. Most samples are answered by static and behavioural analysis in under an hour; full disassembly is reserved for the samples that matter.
- Fundamentals are the moat. Windows internals, the PE file format, x86 and x64 assembly, and one scripting language separate analysts from people who only run sandboxes.
- Few junior roles exist, so build the evidence yourself. An isolated lab, published write-ups of old public samples and YARA rules you have tested are the usual way through the door.
- Handle samples as live weapons. Lab isolation, sample storage, legal limits and employer policy are part of the job description, not optional extras.
What the role does
NIST's NICE Framework includes the task "Perform tier 1, 2, and 3 malware analysis" under its Digital Evidence Analysis work role, which reflects how the work is usually tiered: quick triage, behavioural and static analysis, then deep reverse engineering. Titles vary: malware analyst, malware researcher, reverse engineer, threat researcher, or a senior incident responder who does the malware work on a DFIR team.
| Employer type | What the analyst produces | Typical pace |
|---|---|---|
| In-house SOC or DFIR team | Answers during live incidents: what the sample does, how it persists, what it talks to, what it stole, how to find it on other hosts | Hours, driven by the incident |
| Security vendor (EDR, antivirus, email security) | Detection signatures and behavioural rules at scale, family classification, telemetry research | High volume, automation heavy |
| Threat intelligence team or provider | Family and campaign tracking, configuration extraction, reports linking samples to actors | Days to weeks per report |
| Incident response consultancy | Analysis inside client investigations, often written up for legal and insurance audiences | Engagement driven, travel and on-call possible |
| Government and national CERTs | Analysis reports shared with sectors, support to investigations | Mixed; often security clearance required |
A typical incident request runs like this:
- Acquire safely: receive the sample from EDR quarantine or a forensic image, record its hash, and store it in a password-protected archive in the sample repository, never in email or chat.
- Triage: file type, hashes, strings, imports, packer indicators, signature and reputation lookups, and whether the family is already known.
- Behavioural analysis: run it in an isolated sandbox or lab VM and record processes, files, registry changes, persistence and network activity.
- Static and code analysis: disassemble or decompile the parts that answer open questions, such as how it decrypts its configuration or which credentials it targets.
- Deliver: indicators, a YARA rule, detection ideas mapped to ATT&CK, the scoping queries for EDR and SIEM, and a short report for the incident lead.
The deliverable matters more than the depth. "This loader fetches a second stage over HTTPS (T1105), uses encoded PowerShell (T1059.001), and checks for a virtual machine before running (T1497); search for these three artefacts across the estate" is more useful during an incident than a full disassembly delivered a week later. How samples arrive is covered in the Malware Guide and the Malware Loaders and Droppers Guide.
Core skills and tools
| Skill area | What good looks like | How to practise |
|---|---|---|
| Windows internals | Processes, threads, handles, the registry, services, scheduled tasks, DLL loading and the Windows API calls malware relies on for injection and persistence | Watch normal software with Sysinternals Process Monitor and Process Explorer until abnormal stands out |
| File formats | Read PE headers, sections, imports and resources; recognise Office macro documents, PDF, LNK, ISO and script droppers | Parse benign files first, then old public samples. See the Macro Malware Guide |
| Assembly and code reading | Follow x86 and x64 functions, calling conventions, loops and string decoding; read decompiler output critically | Compile your own small C programs and study them in a disassembler |
| Behavioural analysis | Interpret process trees, file and registry changes and network captures from a sandbox or lab run | Detonate old public samples in an isolated lab with packet capture |
| Obfuscation and anti-analysis | Recognise packing, encoded strings and sandbox checks (ATT&CK T1027 and T1497) and decide whether to unpack or work around them | Unpack known packed samples step by step in a debugger |
| Scripting | Python to decode strings, extract configurations and automate triage; PowerShell and JavaScript reading for script droppers | Write a configuration extractor for one well-documented family |
| Detection writing | YARA rules that match the family without hitting clean files; detection ideas for EDR and SIEM | Test every rule against a clean corpus. See the YARA Rules Guide |
| Writing | Reports that separate fact, assessment and confidence, with indicators in a machine-readable form | Publish write-ups of samples you analysed |
Tools by category: the specific products change, the categories do not.
- Disassemblers and decompilers: Ghidra, which its developer, the US National Security Agency's Research Directorate, describes as "a software reverse engineering (SRE) framework", is free under the Apache 2.0 licence and scriptable in Java or Python. Commercial disassemblers are common in vendor teams.
- Debuggers: a user-mode debugger such as x64dbg for Windows unpacking and dynamic analysis.
- Analysis distributions: prebuilt Windows and Linux analysis VMs (for example FLARE VM and REMnux) save days of setup.
- Sandboxes: automated detonation platforms, self-hosted or commercial, for first-pass behaviour.
- Pattern matching: YARA, which describes itself as "a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples", with rules built from strings and a boolean condition.
- Network and memory: a packet analyser such as Wireshark, and a memory forensics framework for samples that live only in memory. See the Fileless Malware Guide.
Safe handling is a skill in itself. Analyse on dedicated hardware or VMs with no route to production or your home network, use host-only networking or a simulated internet, snapshot and revert after every run, store samples in password-protected archives with their hashes, and never upload a client's sample to a public service without permission, because that can disclose the client's data and tip off the attacker. Check your employer's policy and local law on possessing and sharing malicious code before building a personal sample collection.
Routes into the role
Direct entry-level malware analyst vacancies are rare. The routes that work in practice:
| Starting point | What transfers | Gap to close |
|---|---|---|
| SOC analyst | Alert triage, EDR and SIEM use, ATT&CK, incident pace | Assembly, PE format, debugging; volunteer for the malware samples in your queue. See the SOC Analyst Career Guide |
| Incident responder or DFIR analyst | Evidence handling, memory and disk forensics, report writing | Code-level analysis beyond triage. See the DFIR Analyst Career Guide |
| Software developer (especially C, C++ or systems) | Reading code, compilers, debugging, Windows or Linux APIs | Adversary behaviour, detection, incident context |
| Threat intelligence analyst | Actor and campaign context, reporting | Hands-on analysis. See the Threat Intelligence Analyst Career Guide |
| Graduate in computer science or similar | Programming, operating systems, architecture | Security operations experience; often starts in a SOC or vendor research team |
The US Bureau of Labor Statistics groups this work under information security analysts and gives a bachelor's degree as the typical entry-level education. Its published figures for that broad occupation, a median wage of $129,180 in May 2025 and projected growth of 21% from 2025 to 2035, cover far more than malware analysts, so treat them as context only.
Building evidence: follow the Building a Cybersecurity Home Lab Guide to build an isolated lab, then analyse older, well-documented public samples and write each one up: what it does, how you established it, indicators, a tested YARA rule and the ATT&CK techniques observed. Reverse engineering challenges in capture-the-flag events also count; see the Cyber Ranges, CTFs and Hands-On Training Guide. Never publish live client samples, credentials or victim data found in samples.
Certifications that help
Certifications matter less here than in most security roles: interviews for malware positions usually include a practical exercise or sample walkthrough. Facts below are from the certifying bodies' own pages, as checked 26 Oct 2026; prices and formats change, so confirm before booking.
| Certification | Body | Relevance | Format (as checked 26 Oct 2026) |
|---|---|---|---|
| GREM (Reverse Engineering Malware) | GIAC | The most directly aligned credential; objectives include malicious Office macros, PDFs and RTF files, .NET malware, anti-analysis techniques, unpacking packed malware and reversing functions in assembly | 66 questions, 3 hours, 73% to pass, proctored, with CyberLive practical lab questions. See the GIAC GREM Guide |
| GCFA (Certified Forensic Analyst) | GIAC | Memory forensics, timelines and volatile malicious artefacts: the DFIR side of malware work | 82 questions, 3 hours, 71% to pass, proctored. See the GIAC GCFA Guide |
| GCIH (Incident Handler) | GIAC | Incident handling context for analysts coming from a SOC | See the GIAC GCIH Guide |
| CySA+ (CS0-004) | CompTIA | Broad analyst foundation; useful before specialising | Up to 85 questions, 165 minutes, pass mark 750 on a 100 to 900 scale; V4 launched 23 June 2026 and the V3 English exam retires 22 December 2026 |
| OSED (exploit development) | OffSec | Not a malware certification, but its Windows debugging and assembly content overlaps with reverse engineering | Format not confirmed from the official page at the time of writing; check offsec.com |
Pick one practical credential that matches your target employer rather than collecting several. For the wider landscape see the Blue Team Certifications Guide and the Cybersecurity Certifications Guide.
Progression
| Path | What changes | Read next |
|---|---|---|
| Senior or principal malware researcher | Hardest samples, new families, tooling for the team, public research | YARA Rules Guide |
| Detection engineering | From describing malware to detecting its behaviour at scale, as code | Detection Engineer Career Guide |
| Threat intelligence | From samples to campaigns, actors and strategic reporting | Threat Intelligence Guide |
| Incident response leadership | Running investigations rather than supporting them | Malware Outbreak Playbook |
| Vulnerability research | Reverse engineering legitimate software to find flaws, with responsible disclosure | Vulnerability Analyst Career Guide |
| Team lead or research manager | Prioritisation, quality of reports, sample handling policy, hiring | Cybersecurity Careers Guide |
Choosing: analysts who enjoy the puzzle tend to stay in research; those who enjoy impact on live incidents tend to move into DFIR leadership or detection engineering. In vendor teams, automation skills (pipelines that unpack, classify and extract configurations at scale) increasingly separate senior analysts from mid-level ones. AI assistants now help with code explanation and decompiler cleanup, but their output on obfuscated code is often confidently wrong, so verify in the debugger before reporting.
Where identity fits
Much of today's malware is built to steal identities rather than encrypt disks: infostealers harvest browser passwords, session cookies, cloud CLI credentials, API keys and tokens. Credentials sold from infostealer logs were the source of access in the Snowflake breach, where accounts without MFA were accessed with stolen passwords. A malware report that lists which credential stores a sample targets tells the response team exactly which human and machine credentials to rotate and which sessions to revoke. See the Fileless Malware Guide for in-memory theft techniques.
Measuring your progress
- Time to first useful answer: how long from receiving a sample to delivering indicators and scoping queries the incident lead can use.
- Detection quality: YARA and behavioural rules you wrote that catch the family with no hits on a clean corpus.
- Families analysed end to end: including at least one packed sample you unpacked yourself.
- Report reuse: how often your write-ups are cited by responders, intelligence or detection teams without follow-up questions.
Framework mapping
| Framework | Where malware analysis sits |
|---|---|
| NICE Framework (NIST SP 800-181 Rev. 1) | Digital Evidence Analysis work role, task "Perform tier 1, 2, and 3 malware analysis" |
| NIST CSF 2.0 | DE.AE-02 (potentially adverse events are analysed), RS.AN-03 (analysis to establish what happened and the root cause), ID.RA-02 (threat intelligence received) |
| NIST SP 800-53 Rev. 5 | SI-3 Malicious Code Protection (the signatures and rules analysts feed) |
| MITRE ATT&CK v20 | Shared language for observed behaviour, for example T1027 Obfuscated Files or Information, T1497 Virtualization/Sandbox Evasion, T1105 Ingress Tool Transfer |
Common failure patterns
- Reversing everything: spending days in a disassembler on a commodity family that a sandbox run and a known-family lookup would have answered.
- Leaky labs: analysis VMs with internet access or a bridge to the home or corporate network, which lets a sample call home or spread.
- Uploading client samples publicly: sending a targeted sample to a public scanning service can expose client data and alert the attacker that they have been found.
- Trusting the sandbox verdict: samples that detect virtual machines (T1497) show nothing in an automated run, and a clean report gets read as benign.
- Brittle signatures: YARA rules built on a single string or a hash that miss the next build, or broad rules that flag clean software.
- Reports without actions: technical detail with no indicators, scoping queries or list of credentials to rotate.
Practitioner checklist
- Build an isolated analysis lab with snapshots, a simulated network and no route to any production or home system.
- Learn the PE format, Windows internals and enough x86 and x64 assembly to follow a decoding routine.
- Analyse ten older public samples end to end and publish write-ups with indicators and ATT&CK mappings.
- Write and test YARA rules against both the family and a clean corpus.
- Write one Python configuration or string extractor for a documented family.
- Volunteer for malware triage in your current SOC or DFIR role to gain incident experience.
- Choose one aligned certification, such as GREM, once you have the hands-on basics.
- Agree a written sample handling policy with your employer before collecting or sharing samples.
Standards and references
- CISA NICCS: NICE Framework, Digital Evidence Analysis work role
- GIAC: Reverse Engineering Malware (GREM)
- GIAC: Certified Forensic Analyst (GCFA)
- CompTIA: CySA+ V4 (CS0-004)
- NSA: Ghidra Software Reverse Engineering Framework
- YARA: Documentation
- MITRE ATT&CK: T1497 Virtualization/Sandbox Evasion
- US Bureau of Labor Statistics: Information Security Analysts
Related NHI Mgmt Group resources: Malware Guide · GIAC GREM Guide · DFIR Analyst Career Guide · YARA Rules Guide · Cybersecurity Careers Guide