Senior Security Research Engineer

Elastic

2d • $133,100 - $210,600

About The Position

Elastic is seeking a Senior Security Research Engineer for its Security Endpoint Protections team. The team researches, designs, and builds the visibility and prevention capabilities at the core of Elastic Defend, Elastic’s endpoint and SIEM security solution. The role focuses on developing innovative protections against emerging threats and collaborating with researchers, data scientists, and engineers across Elastic Security in a geographically dispersed, inclusive team.

The engineer will research attacker techniques, develop endpoint visibility and production protections across Windows, macOS, and Linux, reverse engineer malware, and evaluate protection efficacy using customer telemetry. The position also contributes to cross-platform protection parity, technical direction, design and code reviews, mentoring, and publication or presentation of research.

Compensation is base salary only, with no variable compensation component. The role is currently eligible for Elastic’s stock program. Typical starting salary is $133,100–$210,600 USD, or $159,900–$252,900 USD in specified select locations. Elastic also describes a broader benefits package emphasizing employee well-being.

Requirements

• At least 6 years of professional experience analyzing attacker tactics, techniques, and procedures and building detection methods for real security threats.
• At least 6 years of development experience in C, C++, and Python.
• Ability to write safe, fast, and maintainable code for a security-critical codebase.
• Deep operating-system internals knowledge in kernel and user mode; Windows depth is most important, with macOS or Linux depth close behind.
• In-depth reverse-engineering and malware-analysis experience, with familiarity using tools to analyze binaries.
• Adversarial mindset and ability to anticipate evasion and design resilient protections.
• Collaborative mentality and eagerness to learn new skills, platforms, and technologies.
• Proven track record using AI to accelerate development, debug complex systems, and optimize code while owning final outcomes.
• Ability to work autonomously and drive decisions and results in a distributed team using asynchronous, direct, and transparent communication.
• Passion for protecting data from attack.

Nice To Haves

• Vulnerability research and exploit development, particularly responsible disclosure to platform vendors.
• Red teaming experience or experience building offensive tooling and defeating endpoint security products.
• Kernel-mode development, including driver development and debugging.
• Ownership or long-term maintenance of an open-source security tool with an established user base.
• Conference speaking experience or an established publication record.
• Experience applying machine learning to endpoint security problems.
• Familiarity with the Elastic Stack, including Elasticsearch and Kibana, and Elastic Security.

Responsibilities

• Research emerging attacker techniques and turn findings into shipped endpoint protections.
• Study real-world tradecraft involving in-memory threats, injection, credential theft, ransomware, and kernel tampering, and design protections that withstand active evasion.
• Instrument new endpoint event sources across Windows, macOS, and Linux, deepen existing telemetry, and address visibility gaps.
• Develop performant, stable C/C++ production code for endpoint deployments.
• Reverse engineer malware and study how attackers evade endpoint security controls, applying findings to protection design and hardening.
• Evaluate protection efficacy using customer telemetry at fleet scale; investigate false positives and performance regressions and establish mitigation strategies.
• Extend protection parity across Windows, macOS, and Linux, and support new hardware architectures as they reach the enterprise.
• Implement endpoint code with colleagues across countries and time zones, collaborating with detection engineers, malware researchers, and data scientists.
• Lead initiatives spanning multiple releases, contribute to technical direction, raise standards in design and code reviews, and mentor less experienced engineers.
• Publish research on Elastic Security Labs, present at conferences, and contribute to open-source projects.

Benefits

• Company-matched 401(k), with dollar-for-dollar matching up to 6% of eligible earnings.
• Stock program eligibility.
• Health coverage for employees and their families in many locations.
• Flexible locations and schedules for many roles.
• Generous annual vacation days.
• Matching of up to $2,000 (or local currency equivalent) for financial donations and service.
• Up to 40 hours per year for volunteer projects.
• At least 16 weeks of parental leave.
• Competitive pay based on the work performed, not previous salary.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed