The posting
About Monarx
Monarx protects websites from malware and web-based attacks. Our flagship product, ThreatShield, runs at the server level and is offered through hosting partners around the world, so one discovery from our team can protect a huge number of sites at once.
The Threat Research team turns platform signals into protection. We hunt new malware, review files and requests flagged by hosting partners, clean compromised sites, and feed what we learn back into detection. Work is organized into rotating daily assignments, so every analyst builds skills across research, partner support and cleanups.
About the role
As a Threat Research – Tier 1 analyst, you identify malicious code, clean infected websites, handle incidents end to end within SLA, and escalate to Tier 2 or Engineering when an issue needs deeper investigation.
This is a hands-on role for someone who enjoys reading suspicious code, chasing down how a site was compromised, and explaining findings clearly to partners.
Role details
- Location: Fully remote, Americas
- Schedule: Full time, Mon–Fri, 40 hrs/week
- Time off: Unlimited PTO, with prior approval
- Equipment: Company-provided computer
- Language: Fluent English, written and spoken
- Culture: Decentralized
What you'll do
Malware identification
- Analyze suspicious files and requests flagged by the Monarx platform and hosting partners, and classify them as malicious, suspicious or clean.
- Identify common web malware families: backdoors, webshells, SEO spam, phishing kits, credit card skimmers and malicious redirects.
- Deobfuscate PHP and JavaScript to understand what a sample does.
- Document new findings and share them with the team to improve detection.
Website cleanups
- Clean compromised websites, with a focus on WordPress and other common CMS platforms.
- Remove malicious code, files and database injections without breaking site functionality.
- Find the likely point of entry (vulnerable plugin, stolen credentials, outdated core) and recommend hardening steps.
Incident response
- Respond to active security incidents: contain the threat, preserve evidence and restore a clean state.
- Write clear incident summaries for partners and internal teams.
Working with hosting partners
- Act as a technical point of contact for hosting partners on file reviews, detections and cleanup requests.
- Explain findings in plain language and recommend next steps.
- Help investigate possible false positives and report them for root cause analysis.
SLA and escalation
- Work the alert and request queue so every item is acknowledged, updated and resolved within SLA.
- Keep tickets accurate and up to date in our support tools.
- Escalate to Tier 2 or Engineering with complete context when an issue is complex, widespread or product-related.
- Take part in rotating daily assignments across research, partner support and cleanups.
What you bring
- 1–2 years of experience in web security, malware analysis, incident response or a technical support role with a security focus.
- Hands-on experience identifying and removing malware from websites, especially WordPress.
- Experience troubleshooting and repairing broken WordPress sites (white screens, fatal errors, plugin and theme conflicts, database connection errors, broken updates).
- Comfort reading PHP and JavaScript, including obfuscated code.
- Working knowledge of Linux and the command line (grep, find, file permissions, log review).
- Understanding of how web servers, DNS and databases (MySQL/MariaDB) work.
- Familiarity with common web attack vectors: vulnerable plugins, file upload abuse, SQL injection, XSS and credential stuffing.
- Experience working a ticket queue against SLAs and knowing when to escalate.
- Fluent written and spoken English, for tickets, incident summaries, partner calls and team communication.
Nice to have
- Experience at a hosting company, web security vendor or managed WordPress provider.
- Experience with other CMS and e-commerce platforms, such as Magento, Joomla, Drupal, OpenCart and PrestaShop.
- Experience writing or tuning detection rules (YARA, regex signatures).
- Scripting in Bash or Python to automate analysis and cleanup tasks.
- Familiarity with cPanel, Plesk or other hosting control panels.
- Experience with support platforms such as Intercom, and with Slack-based customer channels.
- Spanish or Portuguese, to support partners across the Americas.
- Security certifications or coursework (Security+, GCIH, or similar).
What success looks like
- First 30 days: learn the Monarx platform, our tools and SOPs, and shadow each daily rotation.
- First 90 days: independently handle file reviews, cleanups and partner requests within SLA, with well-documented escalations.
- Ongoing: contribute new malware findings and process improvements that make detection and response faster.
Why join Monarx
- Your work protects sites at hosting-partner scale, not one server at a time.
- A decentralized, fully remote culture that trusts you to own your work, with a small, experienced team that shares knowledge daily.
- Exposure to fresh, real-world web malware every day.
- Clear growth path into Tier 2 Threat Research.
