This listing doesn't post a salary. Most similar roles pay
$152,750–$210,500.
Based on 240 similar postings.
Employer
About Elastic
Elastic is the company behind Elasticsearch and the Elastic Stack (Elasticsearch, Kibana, Beats, and Logstash). It sells search, observability, and security products built on that search engine, primarily through its Elastic Cloud managed service.
Elastic currently has
256 open roles
on FindRole.
Listed pay typically runs
$133,100–$203,000
across 89 roles with salary data.
Senior Security Research Engineer, SONAR (Security Operations and Novel Adversary Research) joins the adversary research team within Elastic Security to identify novel behaviors through malware reverse engineering, threat hunting, and vulnerability research. The role involves deconstructing obfuscated and packed samples across Windows, macOS, and Linux platforms while analyzing telemetry from millions of endpoints to mitigate threats. You will author YARA signatures, develop Python-based automation tools, and leverage AI-assisted workflows to turn discoveries into shipped protections. Key technical requirements include expertise in PE, ELF, and Mach-O formats, knowledge of x86-64 and ARM architectures, and proficiency in network protocols like HTTP and TLS. You will also produce public research for Elastic Security Labs and collaborate on detection engineering projects. The role addresses the critical challenge of making environments hostile to adversaries by uncovering complex malware and providing actionable intelligence.
Reverse engineer undocumented, obfuscated, and packed malware samples across Windows, macOS, and Linux platforms.
Analyze large-scale telemetry data from millions of endpoints to identify and mitigate emerging threats.
Author detection signatures and develop AI-assisted workflows to automate and scale security investigations.
Publish technical research, tools, and detection artifacts to public repositories and at industry conferences.
Collaborate with internal teams to translate research findings into shared threat intelligence and detection models.
Lead long-term investigations and provide technical mentorship to junior researchers on the team.
What we're looking for
6+ years of professional experience reverse engineering malware and researching adversary tradecraft across multiple formats (PE, ELF, Mach-O) and architectures (x86-64, ARM).
Experience in Python development for research tooling and automation, with the ability to read C and C++.
Proficiency in YARA authorship and hunting at scale within large telemetry datasets.
Working knowledge of Windows and Linux internals, network protocols (HTTP/TLS), and applied cryptography.
Ability to produce high-quality technical writing for public analysis and research.
Proven track record of using AI to accelerate development, debug systems, and optimize code.
Vulnerability research or novel technique discovery with a track record of responsible disclosure (preferred).
Participation in CTFs, community standing, or familiarity with the Elastic Stack (preferred).
Malware Reverse Engineering
Python
C
C++
Rust
Go
NodeJS
YARA
Windows
Linux
HTTP
TLS
Cryptography
Elasticsearch
Kibana
MISP
OpenCTI
Detection Engineering
Vulnerability Research
C
C++
Python
Windows
Linux
macOS
Reverse Engineering
Malware Analysis
SIEM
Elasticsearch
Kibana
Machine Learning
Vulnerability Research
Exploit Development
Red Teaming
Open Source
C
C++
Python
Windows
macOS
Linux
Reverse Engineering
Malware Analysis
SIEM
Elasticsearch
Kibana
Machine Learning
Vulnerability Research
Exploit Development
Red Teaming
C++
C
Python
Reverse Engineering
Malware Analysis
Windows
Linux
macOS
Elasticsearch
Kibana
SIEM
Machine Learning
Vulnerability Research
Exploit Development
Red Teaming
Open Source
Security Research
Elasticsearch
Kibana
Machine Learning
Windows
macOS
Linux
Reverse Engineering
Malware Analysis
SIEM
EDR
EPP
TTPs
Assembly
AI-assisted development
Security Research