Senior Security Research Engineer, Security Operations and Novel Adversary Research

Elastic

Confirmed live 2 days ago High trust

Remote

Quick summary

Work type: Remote
Location: Remote
Salary: $133,100–$210,600 / yr
Posted: 15 days ago
Freshness: Confirmed live 2 days ago

Market check

Salary context

Competitive pay

How this pay compares to similar roles

Similar $180k

This role $172k

$123k most similar roles pay here $230k

This role pays less than 51% of similar roles. Most pay $151,493–$209,500 — the shaded band above. At the midpoint, this role pays about $172k versus about $180k for comparable roles.

Based on 240 similar postings.

Employer

About Elastic

Elastic is the company behind Elasticsearch and the Elastic Stack (Elasticsearch, Kibana, Beats, and Logstash). It sells search, observability, and security products built on that search engine, primarily through its Elastic Cloud managed service.

Elastic currently has 240 open roles on FindRole.

Listed pay typically runs $133,100–$210,600 across 91 roles with salary data.

Most-posted roles

View all roles at Elastic

At a glance

TL;DR · Senior Security Research Engineer, Security Operations and Novel Adversary Research

Role Posting Log in to save

Senior Security Research Engineer, SONAR (Security Operations and Novel Adversary Research) joins the adversary research team within Elastic Security to identify novel behaviors through malware reverse engineering, threat hunting, and vulnerability research. The role involves taking apart undocumented, obfuscated, and packed samples across Windows, macOS, and Linux platforms to uncover communication methods and hidden configurations. You will operate global data systems to mitigate threats, author YARA signatures, and build AI-assisted workflows to automate investigations. Key requirements include over six years of experience with PE, ELF, and Mach-O formats, proficiency in Python for tooling, and the ability to read C and C++. Candidates must possess a strong understanding of network protocols like HTTP and TLS, as well as applied cryptography. You will also produce public research on Elastic Security Labs and mentor junior researchers while shaping the team's technical direction.

Skills

Malware Reverse Engineering Python C C++ Rust Go NodeJS YARA Windows Linux HTTP TLS Cryptography Elasticsearch Kibana MISP OpenCTI Machine Learning

What you'll do

Reverse engineer undocumented malware across Windows, macOS, and Linux to uncover communication and evasion tactics.
Analyze large-scale telemetry data from millions of endpoints to identify and mitigate emerging threats.
Author detection signatures and develop AI-assisted workflows to automate and scale security investigations.
Publish technical research, tools, and detection artifacts to public repositories and at industry conferences.
Collaborate with internal teams to translate research findings into shared threat intelligence and detection models.
Lead long-term investigations and provide technical mentorship to junior researchers on the team.

What we're looking for

6+ years of professional experience reverse engineering malware and researching adversary tradecraft across multiple formats and architectures.
Experience with Python for research tooling and automation, plus the ability to read C and C++.
Proficiency in YARA authorship and hunting at scale within large telemetry datasets.
Working knowledge of Windows and Linux internals, network protocols (HTTP/TLS), and applied cryptography.
Strong technical writing skills to produce clear, public analyses based on complex investigations.
Proven track record of using AI to accelerate development, debug systems, and optimize code.
Ability to manage multiple projects simultaneously while adapting to dynamic business priorities.
Export controls.