Marion Marschalek

Marion Marschalek is an Austrian reverse engineer and malware analyst who has worked in binary analysis and threat research since 2011. She holds both a bachelor's and a master's degree in Information Security from the University of Applied Sciences St. Pölten in Austria, and describes her approach to malware analysis as treating hostile code like a puzzle to be taken apart.

Early Career

Marschalek's confirmed career began as a malware analyst at Ikarus Security Software in Austria. Industry press and conference archives from the mid-2010s widely associate her with subsequent roles at the German antivirus vendor G DATA and at the threat-intelligence firm Cyphort, and credit her with research into nation-state-linked malware, including G DATA's widely cited 2014 analysis of the Uroburos (also known as Snake or Turla) espionage rootkit. She is also reported to have spent time at Google. These specific employers and her exact talk history at Black Hat, DEF CON, and the Chaos Communication Congress (CCC) are commonly repeated in secondary sources but could not be independently re-confirmed against primary sources during this research pass — readers should treat them as reported rather than verified here. One concrete data point: the official DEF CON 23 (2015) speaker index lists Marschalek's name cross-referenced with researcher Morgan Marquis-Boire, indicating a joint appearance that year, though the associated talk materials could not be located to confirm its title or content.

Intel and AWS

Marschalek later spent three years on Intel's STORM team in Oregon, researching hardware-level vulnerabilities. From 2020 to 2024 she worked on Amazon Web Services' GuardDuty team, where her focus shifted to cloud threat detection, with particular attention to attacks targeting Linux systems.

Hack & Cheese and Community Work

In February 2025, Marschalek left AWS to found Hack & Cheese Security Consulting, an independent reverse-engineering consulting and training practice based in Portland, Oregon. Through it she continues to teach reverse engineering, including a MIPS-focused workshop delivered at the 2026 Recon security conference. She also maintains a set of open-source reverse-engineering tools on GitHub, including r2graphity, which builds function call graphs on top of the radare2 framework, and DiffRay, a tool for diffing Windows library binaries using IDA Pro output. Marschalek is a long-standing contributor to BlackHoodie, a volunteer initiative branded "Women who RE" that offers free, one-day reverse-engineering training sessions for women at major security conferences worldwide, including Recon, OffensiveCon, Troopers, Hexacon, and Sec-T.

Timeline

• 2011Began working as a malware analyst at Ikarus Security Software in Austria, starting a career in reverse engineering.
• 2014Period during which G DATA SecurityLabs published widely cited research on the Uroburos/Snake nation-state espionage rootkit, which Marschalek is widely, though not independently, reported to have contributed to.
• 2015Listed in DEF CON 23's official speaker index, cross-referenced with researcher Morgan Marquis-Boire.
• 2020Joined Amazon Web Services, working on the GuardDuty cloud threat detection team.
• 2024Completed a four-year tenure on the AWS GuardDuty team.
• 2025-02Founded Hack & Cheese, an independent reverse-engineering consulting and training practice in Portland, Oregon.
• 2026Delivered a MIPS reverse-engineering workshop at the Recon security conference.