Reverse Engineer / Malware Analyst
Take apart software to understand how it works — especially when it is malicious.
What does a Reverse Engineer / Malware Analyst do?
Reverse engineers analyse compiled software without access to the source code — used to understand malware, find vulnerabilities, and validate security claims. The work requires patience, strong fundamentals in how computers actually work, and a knack for pattern recognition. This path takes time to get into but pays off significantly. Good fit if you enjoy deep technical problems and want to specialise in something most people never attempt.
Who it fits
People who love understanding how things work under the hood and enjoy detective-style investigation more than building new features.
Suits independent, detail-oriented learners who enjoy puzzle-solving and are not put off by spending hours on a single problem.
Skills you need
Tools you will use
Starter projects
Good projects to practise and add to a portfolio.
- Reverse a simple crackme binary using Ghidra
- Write a basic YARA rule to detect a malware pattern
- Analyse a malware sample in a sandboxed VM
- Solve a binary exploitation challenge on pwn.college
// ROADMAP
Reverse Engineer / Malware Analyst career roadmap
Estimated time: 12–18 months
Badges show what each resource is. Only items marked certification lead to a professional credential — everything else is learning material.
C Programming & Memory
8–10 weeksReverse engineering is about understanding compiled C. Learn C first — pointers, memory allocation, structs, and how the stack and heap work. CS50x covers this well.
x86 Assembly Language
6–8 weeksWhen you disassemble a binary, you see assembly. Learn x86/x64 assembly — registers, the stack frame, calling conventions, common instruction patterns. pwn.college teaches this brilliantly.
Static Analysis with Ghidra
4–6 weeksGhidra is the NSA's free reverse engineering tool and the most accessible starting point. Learn to navigate functions, rename variables, add comments, and understand what decompiled C is trying to tell you.
Dynamic Analysis & Debugging
4–6 weeksStatic analysis tells you what code exists. Dynamic analysis tells you what it does at runtime. Learn x64dbg for Windows, GDB for Linux. Set breakpoints, inspect memory, trace execution.
CTF Challenges & Real Malware
OngoingPractice on picoCTF (beginner), then progress to more advanced RE challenges. Analyse real malware samples in an isolated VM. Write up your analysis — this is your portfolio.
// START LEARNING
Reverse Engineer / Malware Analyst learning resources
Videos first — they're the fastest way to get moving — then reading, hands-on practice and courses. Only resources badged professional certification award a formal credential.
Modern Embedded Systems Programming: Getting Started
Quantum Leaps
The starting lesson for a practical series on microcontrollers, low-level C and hardware-aware programming.
Learning resource. This does not award a professional certification.
Linux Journey
LabEx
Short progressive lessons on the command line, permissions, processes, networking and system administration.
Certificate availability depends on the course provider.
Getting Started with Ghidra
Ghidra
Official setup and orientation for static analysis, decompilation and navigating binaries in Ghidra.
Learning resource. This does not award a professional certification.
Reverse Engineering
pwn.college
Hands-on challenges for assembly, binary analysis, debugging and program behaviour.
Learning resource. This does not award a professional certification.
Bandit Wargame
OverTheWire
Progressive command-line security challenges that build Linux, SSH and problem-solving fluency.
Learning resource. This does not award a professional certification.
// PRACTISE
Gain Reverse Engineer / Malware Analyst work experience
Build practical evidence before your first role. Provider terms and eligibility can change.
GitHub · Good first issues
open-source · REMOTE
Find newcomer-labelled issues and build evidence of collaboration in public repositories.
pwn.college · Program security challenges
hands-on-lab · REMOTE
Complete structured binary exploitation and reverse-engineering challenges in an online practice environment.
// FIND WORK
Find Reverse Engineer / Malware Analyst jobs
Start with “Reverse Engineer”. Platforms without stable public search URLs open with this suggested phrase.
LinkedIn Jobs
Broad professional job search with keyword, location, experience-level and remote filters.
Wellfound
Startup and technology roles with company and compensation context.
Dice
Specialist technology roles across engineering, data, security and infrastructure.
Built In
Technology and startup job discovery, including remote and city-focused listings.
UK visa and international opportunities
Sponsorship depends on the employer, vacancy and current immigration rules. Use the linked official guidance and verify every role before applying.
Going independent
Malware analysis and vulnerability research are high-value independent paths. The skill set is rare enough that demand consistently exceeds supply.
Malware Analysis Consulting
Medium effortProvide malware analysis services to companies that have experienced or fear security incidents.
Examples
- Incident response malware analysis
- Threat intelligence report writing
- Custom malware detection signature development
- Forensic analysis of compromised systems
Getting started
- 1. Build public malware analysis writeups to establish credibility
- 2. Get Blue Team certifications (BTLO) alongside your reverse engineering skills
- 3. Reach out to incident response firms for subcontracting opportunities
- 4. Publish YARA rules and detection content publicly to demonstrate capability
Vulnerability Research
High effortFind and responsibly disclose vulnerabilities in software for bounties or coordinated disclosure credits.
Examples
- Browser and OS vulnerability research
- Firmware vulnerability analysis
- IoT device security research
- Network protocol implementation bugs
Getting started
- 1. Start with CTFs and public CVE analysis to build foundational skills
- 2. Set up a dedicated research environment with instrumentation tools
- 3. Target software with active bug bounty programmes initially
- 4. Publish findings through proper coordinated disclosure channels
Communities & tools
// EARNING POTENTIAL
Earning potential
2025Rare skill set with high demand in government, defence, and threat intelligence. Security clearance holders with RE experience earn significantly above these base ranges.
Freelance rates
Day rate
£400–£900
Hourly rate
£50–£115
What affects salary
- Government and GCHQ-adjacent roles with SC/DV clearance pay a major premium
- Malware analyst experience at AV vendors and threat intelligence firms is well-paid
- Vulnerability research publication history is a strong differentiator
- IDA Pro and Ghidra expertise paired with C and assembly fluency is the standard
- CTF competition success (pwn.college, Defcon CTF) is a recognised hiring signal
🌍 US reverse engineers at government contractors (NSA, CISA-adjacent) earn $120k–$200k+. UK defence sector pays well but government rates vary.
Based on: LinkedIn Salary · Glassdoor UK · CyberSeek · Security Cleared Jobs. All figures approximate.
// RESOURCES
Free resources to get started
Recommended starting points — no payment required.
- Course
- Lab
- Lab
- Reading
- Lab
Paid courses worth considering
These are not required — free resources above can get you far.
- Course
- Course
Browse all resources
Resource directory.
Free and paid resources across every tech career path — searchable and filterable.
Not sure this fits?
Take the assessment.
Answer a few short questions and get your top matches — with reasons why they fit you.
Wondering if you are ready for this path? Analyse your CV →
Related careers
Compare paths that share skills, tools or ways of working.