The virus check should happen whenever the content datastream is saved, though now that I write that, I think we've probably implemented this at the controller layer rather than at the model layer in which case, we would indeed need that in the job.