Senior Security Research Engineer, SONAR (Security Operations and Novel Adversary Research)

Elastic
Canada, Ireland, Norway, Poland, Spain, United Kingdom, United States
Full timeUSD 133,100 - 210,600 annuallyFunction: Research & Scientific (R&D)Experience: 6+ yearsSkills: ["Communication","Collaboration","Mentorship","Technical writing","Eagerness to learn"]

Reverse engineer novel malware and analyze adversary tradecraft to uncover what attacks, how they persist, and how they communicate. Operate large-scale global telemetry to identify threats and build campaign context, then turn discoveries into shipped protections via YARA signatures and automation. Publish research on Elastic Security Labs, release detection artifacts to public GitHub repos, and help set long-term technical direction for the distributed SONAR team.

Loading

Loading job details...

Preparing the role view and application actions.

FursaFursa
Elastic
Elastic
20 hours ago

Senior Security Research Engineer, SONAR (Security Operations and Novel Adversary Research)

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI
Last checked: 7 hours agoStatus: Live

Job Summary

Reverse engineer novel malware and analyze adversary tradecraft to uncover what attacks, how they persist, and how they communicate. Operate large-scale global telemetry to identify threats and build campaign context, then turn discoveries into shipped protections via YARA signatures and automation. Publish research on Elastic Security Labs, release detection artifacts to public GitHub repos, and help set long-term technical direction for the distributed SONAR team.
Location: Canada, Ireland, Norway, Poland, Spain, United Kingdom, United States
Employment Type: Full time
Job Function: Research & Scientific (R&D)
Seniority: Mid level

Key Responsibilities

  • •Reverse engineer malware and deobfuscate/ unpack samples across Windows, macOS, and Linux to recover communication, configuration, and stealth behavior.
  • •Operate global telemetry systems to identify and mitigate threats, build investigation context, and drive fleet-wide mitigations.
  • •Turn discoveries into shipped protections by authoring signatures and building automation and AI-assisted workflows for faster investigations.
  • •Publish public research via Elastic Security Labs and release tools/detection artifacts to public GitHub repositories; present at conferences.
  • •Collaborate with Elastic Security teams and help lead SONAR’s technical direction by mentoring researchers and raising review quality.

Pay and Benefits

Salary: USD 133,100 - 210,600 annually
Equity and Bonus:Equity
Perks:401kHealth InsuranceParental LeavePaid Leave

Key Requirements

  • •6+ years of professional experience reverse engineering malware and researching adversary tradecraft using static and dynamic analysis across Windows/macOS/Linux.
  • •Ability to work with obfuscated and packed samples across multiple executable formats (PE, ELF, Mach-O) and architectures (x86-64, ARM).
  • •Python experience for research tooling and automation, with willingness to learn new runtimes (Rust, Go, NodeJS).
  • •YARA authorship and hunting at scale, with the ability to find weak signals in large telemetry datasets.
  • •Working knowledge of Windows/Linux internals, network protocols (HTTP, TLS), and applied cryptography, plus strong technical writing skills.
Experience:6+ years
Skills:CommunicationCollaborationMentorshipTechnical writingEagerness to learn
Languages:English
Tech Stack:PythonCC++RustGoNodeJSYARAWindowsLinuxPEELFMach-OX86-64ARMHTTPTLSCryptographyAIMachine learningElasticsearch

Company Brief

Elastic
Builds the Elastic Stack (Elasticsearch, Kibana, Beats, Logstash) and provides search, observability, and security solutions that enable organizations to search, analyze, and protect data in real time across applications, infrastructure, and enterprises.
Industry: Data Infrastructure
Company Size: Enterprise (1,001+ employees)
Revenue: USD 1B+
Growth: Public Company
Valuation: Public Company (Market Cap in USD)
Funding: IPO / Publicly Listed
Headquarters: Amsterdam, Netherlands
Founded: 2012
WebsiteLinkedIn