Junior Engineer - Working Student Thesis

At Gen, we are scrappy and relentlessly customer driven. We create room for healthy debate, experimentation and continuous learning, and we seek out people with different experiences, identities and ideas to join our team. You’ll work with people who back each other, respect each other and understand that our differences are a competitive advantage.

If this sounds like you, we’d love you to be part of Gen.

About the Role:
Some malware never shows its hand in our sandbox. It checks the CPU count, looks for a debugger, times a sleep call, notices the disk is suspiciously clean — and then quietly exits, leaving us with an empty report on a sample that other detection layers already flagged as malicious. Every one of those silent failures is a gap in Gen Digital's dynamic analysis coverage.
Your job is to close those gaps. You'll go hunting for the samples that slipped through, take them apart with a disassembler and a debugger, and work out exactly which trick they used to spot the sandbox. Then you'll fix it — in CAPEv2, in Hypermon, or wherever in the analysis stack the tell originates — and prove the sample now detonates properly.
It's a loop of reverse engineering, detective work, and hands-on systems engineering, run against real threats at real volume.

Key Responsibilities:

Get familiar with sandboxing and the current state of anti-sandbox and evasion techniques.

Study the design and operation of the CAPEv2 and Hypermon sandbox systems and the malware analysis ecosystem used at Gen Digital, including the associated BigQuery result storage system.

Search for and classify suspicious samples in BigQuery — samples confirmed as malware by other means but missed by the company's dynamic analysis systems.

Reverse engineer those samples to identify new, as-yet-undetected anti-sandbox techniques.

Propose and implement improvements to the sandbox or its related components so that evasive samples execute and are analyzed successfully.

Validate the effectiveness of the improvements, evaluate the contribution of the work, and outline directions for future development.

About You:

You reverse engineer for real — comfortable in IDA, Ghidra, or Binary Ninja, and equally at home in a debugger watching a sample decide whether to run.

You know x86/x64 assembly well enough to read obfuscated, packed, or anti-analysis-hardened code without losing the thread.

You understand Windows internals — the API surface, process and memory structures, drivers, the places malware looks when it wants to know where it is.

You have a working knowledge of virtualization and emulation, and an intuition for the artifacts they leave behind.

You write code, not just read it. Python for tooling and automation; C/C++ where the fix has to live close to the metal.

You're comfortable with SQL and large datasets — you'll be mining BigQuery to find the samples worth your attention rather than waiting for someone to hand you a list.

You're genuinely curious about how things fail. The interesting question isn't "did it evade us" but "what exactly did it see, and what else can see it."

You're methodical about evidence. A hypothesis about an evasion technique isn't finished until you've shown the fix changes the outcome.

You're a team player — you'll work alongside sandbox engineers, threat analysts, and detection teams, and your findings need to land with all of them.

You can drive an open-ended investigation on your own and know when to surface a dead end instead of grinding on it.

You're comfortable working in English, written and spoken.

Nice to have: experience with CAPEv2, Cuckoo, or similar dynamic analysis platforms; hypervisor-level introspection; unpacking and deobfuscation work; kernel-mode development; prior threat intelligence or detection engineering experience.
What's Next

Interview Structure:

Intro call (30 min) — A conversation with the hiring manager about your background and what you're looking for, plus an overview of the team, the sandbox stack, and where this work sits in Gen Digital's threat analysis pipeline.

Technical interview (60–90 min) — A working discussion on reverse engineering, Windows internals, and anti-analysis techniques. We'll walk through a piece of code together and talk about evasion you've encountered in the wild.

Deep dive with the team (60 min) — You'll meet the engineers and analysts you'd work with day to day. Expect a practical design conversation: given a sample that exits silently, how would you find out why, and how would you fix the sandbox without breaking everything else running on it.

Final conversation & offer — Team fit, your questions, practical details, and next steps.