Security Analyst Infected Websites

Defiant, makers of Wordfence, is a small, dynamic, fast-growing, and profitable company with loyal customers who love our products and services. We are the global leader in Word Press security, protecting over 5 million websites.

We're seeking a Security Analyst to work on an hourly contract basis from your home office, with 100% availability during that time.

• Weekdays:
  Monday‑Friday, 9:00 AM – 5:00 PM ET (40 hrs/wk)
• Weekends:
  Saturday‑Sunday, 11:00 AM – 7:00 PM ET (16 hrs/wk)

Candidates in regions where these hours strongly align with their normal business hours are encouraged to apply. You do not have to be based in the USA.

Contract rate: $35+ USD per hour, depending on experience.

You’ll work with a talented and motivated team that is friendly, fast‑moving, self‑managing, and highly capable with a sense of humor. Our team's family time is important; we don't typically require long hours when we can avoid it, which is almost always. Our entire team works remotely using Slack for casual interaction. There's no micro‑management here—we trust that you will see tasks through to completion and communicate with your fellow team members or ask for help when needed.

At Defiant, “trust” is the attribute we value most highly among our team members. We need to know that you can grab a task, communicate clearly with stakeholders, and see the task to completion with superb attention to detail.

We use apps like Slack, Git Hub, and Google Apps for our workflow.

We are looking for Security Analysts to join our Care and Response Team. You will assist our customers and investigate site intrusions, as well as repair their sites and remove all traces of compromise.

Additionally, you will collect and process evidence from intrusions that will help improve our threat detection. You will need to determine how the intrusion occurred, collect all IOCs (indicators of compromise), and work with our Threat Intelligence team on vulnerability research and malware signature development.

In your downtime, you will triage and validate vulnerability reports submitted through our Bug Bounty Program. You’ll assess impact to prioritize submissions, reproduce and analyze vulnerabilities in controlled environments, and identify root causes in source code. You will document findings, recommend fixes or custom firewall rules, and propose bounty amounts based on severity and impact.

You will collaborate with developers, customer support, and disclosure teams, as well as validate that patches are sufficient once released.

• Highly technical and comfortable with a wide range of open source tools such as grep, find, etc.
• Excellent written and verbal communication skills.
• Ability to interact with customers professionally.
• Work well in a team and work independently without additional guidance.
• Excellent analytical ability, ability to think outside of the box, and an eagerness to learn.
• Must have attention to detail.

• 3+ years of experience with Word Press required.
• Technical experience with common web application based vulnerabilities in Word Press plugins and themes.
• A solid understanding of Word Press hooks, how they are used, and how they can lead to vulnerabilities.
• Experience with administering multiple Linux stacks (we don’t support Windows).
• Experience with MySQL.
• 2+ years of experience conducting remediation of compromised websites, including analysis of how the intrusion occurred, removing the intrusion vector, and restoring the site to a fully functional state.
• Experience in vulnerability research (including proof‑of‑concept development, replicating exploits, reviewing source‑code changes, generating/modifying HTTP requests, using Burp suite or similar proxy software, and a PHP debugger).
• A solid understanding of regular expressions. Must be able to write expressions on the fly to match and remove only malicious code (often polymorphic) without affecting any legitimate code, and to write malware signatures for our products.
• Ability to write and read PHP, regular expressions, cron jobs, and JavaScript.
• Understanding of all major vulnerability types and the ability to…