Senior Security Research Engineer, SONAR (Security Operations and Novel Adversary Research)

Elastic
United States
Full timeUSD 133,100 - 210,600 annuallyFunction: Research & Scientific (R&D)Skills: ["Collaboration","Clear communication","Mentorship","Technical writing","Eagerness to learn"]

Join Elastic Security’s SONAR adversary research team to reverse engineer novel malware and analyze real-world attacker behavior across Windows, macOS, and Linux. Operate global data systems to identify high-value threats, author YARA signatures, and ship protections via automation and AI-assisted workflows. Publish research publicly through Elastic Security Labs, release tools to public GitHub, and help set the team’s technical direction while mentoring researchers.

Loading

Loading job details...

Preparing the role view and application actions.

FursaFursa
Elastic
Elastic
2 days ago

Senior Security Research Engineer, SONAR (Security Operations and Novel Adversary Research)

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI
Last checked: 5 hours agoStatus: Live

Job Summary

Join Elastic Security’s SONAR adversary research team to reverse engineer novel malware and analyze real-world attacker behavior across Windows, macOS, and Linux. Operate global data systems to identify high-value threats, author YARA signatures, and ship protections via automation and AI-assisted workflows. Publish research publicly through Elastic Security Labs, release tools to public GitHub, and help set the team’s technical direction while mentoring researchers.
Location: United States
Employment Type: Full time
Job Function: Research & Scientific (R&D)
Seniority: Mid level

Key Responsibilities

  • •Reverse engineer undocumented malware samples across Windows, macOS, and Linux, recovering communications, configuration, and evasion behavior.
  • •Use global telemetry data from millions of endpoints to surface and mitigate threats, build campaign context, and drive fleet-wide mitigations.
  • •Turn discoveries into shipped protections by authoring signatures and building automation and AI-assisted workflows to accelerate investigations.
  • •Publish public research through Elastic Security Labs, release tools and detection artifacts to public GitHub repositories, and present at conferences.
  • •Lead technical direction by owning long-running investigations, raising review quality, mentoring earlier-career researchers, and collaborating across Elastic Security.

Pay and Benefits

Salary: USD 133,100 - 210,600 annually
Equity and Bonus:Equity
Perks:Health Insurance401kParental LeaveVolunteer Time

Key Requirements

  • •6+ years of professional experience reverse engineering malware and researching adversary tradecraft using static and dynamic analysis across multiple executable formats and architectures.
  • •Experience using Python for research tooling and automation, with the ability to read C and C++.
  • •Ability to write and hunt with YARA signatures at scale, validating detections against next variants and weak signals in large telemetry datasets.
  • •Strong fundamentals in Windows and Linux internals, network protocols including HTTP and TLS, and applied cryptography to recognize protection of configuration blobs.
  • •Technical writing ability to turn investigations into clear public analyses other defenders can act on.
Experience:Malware reverse engineeringThreat huntingAdversary researchSecurity operationsVulnerability research
Skills:CollaborationClear communicationMentorshipTechnical writingEagerness to learn
Languages:English
Tech Stack:PythonCC++RustGoNodeJSYARAWindowsLinuxHTTPTLSElastic StackElasticsearchKibanaGitHubAI

Company Brief

Elastic
Builds the Elastic Stack (Elasticsearch, Kibana, Beats, Logstash) and provides search, observability, and security solutions that enable organizations to search, analyze, and protect data in real time across applications, infrastructure, and enterprises.
Industry: Data Infrastructure
Company Size: Enterprise (1,001+ employees)
Revenue: USD 1B+
Growth: Public Company
Valuation: Public Company (Market Cap in USD)
Funding: IPO / Publicly Listed
Headquarters: Amsterdam, Netherlands
Founded: 2012
WebsiteLinkedIn