Senior Security Research Engineer, Security Operations and Novel Adversary Research

Elastic

Confirmed live yesterday High trust

Remote

Quick summary

Work type: Remote
Location: Canada
Salary: $128,300–$203,000 / yr
Posted: 16 days ago
Freshness: Confirmed live yesterday

Market check

Salary context

Competitive pay

How this pay compares to similar roles

Similar $180k

This role $166k

$117k most similar roles pay here $231k

This role pays less than 60% of similar roles. Most pay $151,493–$209,500 — the shaded band above. At the midpoint, this role pays about $166k versus about $180k for comparable roles.

Based on 240 similar postings.

Employer

About Elastic

Elastic is the company behind Elasticsearch and the Elastic Stack (Elasticsearch, Kibana, Beats, and Logstash). It sells search, observability, and security products built on that search engine, primarily through its Elastic Cloud managed service.

Elastic currently has 240 open roles on FindRole.

Listed pay typically runs $133,100–$210,600 across 91 roles with salary data.

Most-posted roles

View all roles at Elastic

At a glance

TL;DR · Senior Security Research Engineer, Security Operations and Novel Adversary Research

Role Posting Log in to save

Senior Security Research Engineer, SONAR (Security Operations and Novel Adversary Research) joins the adversary research team within Elastic Security to identify novel behaviors through malware reverse engineering, threat hunting, and vulnerability research. The role involves deconstructing undocumented, obfuscated, and packed samples across Windows, macOS, and Linux platforms to uncover communication methods and hidden configurations. You will operate global data systems to mitigate threats, author YARA signatures, and build AI-assisted workflows to automate investigations. Key requirements include over six years of experience with PE, ELF, and Mach-O formats, proficiency in Python for tool development, and the ability to read C and C++. Candidates must possess a strong understanding of network protocols like HTTP and TLS, as well as applied cryptography. You will also produce public research for Elastic Security Labs and mentor junior researchers while shaping the team's technical direction.

Skills

Malware Reverse Engineering Python C C++ Rust Go NodeJS YARA Windows Linux HTTP TLS Cryptography Elasticsearch Kibana MISP OpenCTI Detection Engineering

What you'll do

Reverse engineer undocumented malware across Windows, macOS, and Linux to uncover communication methods and hidden behaviors.
Analyze large-scale telemetry data from millions of endpoints to identify and mitigate emerging security threats.
Author detection signatures and develop automated, AI-assisted workflows to scale investigation capabilities.
Publish technical research, tools, and detection artifacts to public repositories and at industry conferences.
Collaborate with internal teams to translate research findings into production rules and shared threat intelligence.
Lead long-term investigations and provide technical mentorship to junior researchers on the team.

What we're looking for

6+ years of professional experience reverse engineering malware and researching adversary tradecraft across multiple formats and architectures.
Experience with Python development for research tooling and automation, plus the ability to read C and C++.
Proficiency in YARA authorship and hunting at scale within large telemetry datasets.
Working knowledge of Windows and Linux internals, network protocols (HTTP/TLS), and applied cryptography.
Strong technical writing skills to produce clear, public analyses based on complex investigations.
Proven track record of using AI to accelerate development, debug systems, and optimize code.
Ability to transition seamlessly between different projects, codebases, or scrum teams based on business priorities.
Export controls.