Software Reverse Engineer

Location: Bethesda, MD
Security Clearance: Active TS/SCI [Required]
Job Type: Full-Time
Target Salary Range*: $120,000 - $180,000

*This represents the potential salary range for this position depending on education level, years of experience and/or certifications in addition to other position specific requirements which may impact salary

The Software Reverse Engineer performs in-depth analysis of software, firmware, and hardware systems to determine functionality, identify vulnerabilities, and understand operational context. The role combines dynamic system analysis, static binary reverse engineering, and document exploitation to understand how systems support mission objectives.

• Analyze compiled software and binaries using forensic techniques to extract artifacts, understand system architecture, and identify key software components.

• Use virtualization and sandboxing environments, including VMware and KVM/QEMU, to observe software in its native operating environment.

• Perform system call tracing, network monitoring, and file system analysis to identify real-time behaviors and interactions.

• Perform live, on-system debugging to trace code execution.

• Correlate dynamic findings with static analysis from Ghidra and IDA Pro to validate assumptions, understand complex logic, and uncover obfuscated functionality.

• Use Ghidra and IDA Pro to decompile and disassemble software.

• Analyze code paths, extract indicators, and identify hidden or malicious logic that may not be apparent through dynamic analysis.

• Identify vulnerabilities, undocumented features, and novel capabilities within target systems.

• Develop proof-of-concept exploits and assess their potential operational impact.

• Model and simulate features and functions to understand how software was developed, compiled, and deployed.

• Use disk imagers, virtual machine managers, network scanners, and debuggers to perform end-to-end exploitation.

• Mentor junior engineers in software reverse engineering methodologies, tools, and techniques.

• Meet one of the following education and experience combinations: [Required]

  • Bachelor’s degree with 8+ years of relevant experience.

  • Master’s degree with 6+ years of relevant experience.

  • PhD with 3+ years of relevant experience.

• An additional 4 years of relevant experience or specialized training may be considered in lieu of a bachelor’s degree.

• 3+ years of demonstrated software reverse engineering experience. [Required]

• Experience with static analysis tools such as IDA Pro, Ghidra, and Binary Ninja. [Required]

• Experience with debugging tools such as WinDbg, GDB, and similar platforms. [Required]

• Experience with virtualization, sandboxing, and emulation tools such as VMware, KVM, and QEMU. [Required]

• Experience with the software reverse engineering toolchain, including network analysis tools such as Wireshark and Nmap. [Required]

• Experience mounting, modifying, and extracting artifacts from raw forensic disk images. [Required]

• Experience in Linux/Unix environments, including advanced command-line operations and system-level administration. [Required]

• Understanding of Windows and Linux operating system internals, x86/x64 and ARM assembly, and CPU architecture. [Required]

• Linux command-line proficiency. [Required]

• Ability to unpack, de-obfuscate, and analyze highly complex malicious applications. [Required]

• Knowledge of low-level programming languages, including C, C++, and Assembly, and scripting languages such as Python, Java, or .NET. [Required]

• Understanding of common security practices and the ability to identify security flaws in software architecture. [Required]

• Active TS/SCI clearance with Polygraph. [Required]

• Location: NDOC, Bethesda, MD (full-time on-site). [Required]

• A degree in Information Technology, Cybersecurity, Computer Science, Information Systems, Data Science, or Software Engineering is highly desired.

• Background in material exploitation, malware analysis, or vulnerability research.

• Knowledge of advanced firmware analysis techniques and methodologies.

• Knowledge of secure boot processes.

• Familiarity with hardware-level attack techniques, such as side-channel analysis or fault injection.

• Experience with Field Programmable Gate Array (FPGA) development.

• Experience monitoring hardware-level buses and interfaces, such as I2C, USB, or JTAG.

• Familiarity with risk assessment and mitigation strategies for firmware vulnerabilities.

• Strong documentation skills for maintaining detailed records of analysis processes and findings.

• Active DoD 8570 IAT Level II certification.