Senior Security Research Engineer

Senior Security Research EngineerElastic, the Search AI Company, enables everyone to find the answers they need in real time, using all their data, at scale — unleashing the potential of businesses and people. The Elastic Search AI Platform, used by more than 50% of the Fortune 500, brings together the precision of search and the intelligence of AI to enable everyone to accelerate the results that matter. By taking advantage of all structured and unstructured data — securing and protecting private information more effectively — Elastic's complete, cloud-based solutions for search, security, and observability help organizations deliver on the promise of AI.
What Is The RoleThe Elastic Security Endpoint Protections team researches, designs, and builds the visibility and prevention capabilities at the core of Elastic Defend, our endpoint and SIEM security solution. We are looking for a Senior Security Research Engineer to help lead our efforts to build innovative features that secure our users against the latest emerging threats. You will collaborate with the broader Elastic Security team, a diverse group of skilled researchers, data scientists, and engineers who bring deep domain knowledge in their respective areas. Our geographically dispersed team values positivity and inclusivity in the workplace, clear communication, collaborative learning, and guided mentorship.
We don't just claim our protections work. In recent third-party enterprise protection testing, Elastic Security earned a perfect malware protection score with zero false alarms, the top result in the field. If you have a passion for security research and would enjoy the challenge of devising novel methods for thwarting malicious actors in an ever-evolving threat landscape, join our growing teamWhat You Will Be DoingResearch emerging attacker techniques and turn them into shipped protections.
Build and extend endpoint visibility.
Develop production code that runs everywhere.
Reverse engineer malware and study evasion.
Own efficacy end to end.
Extend protection parity across platforms.
Collaborate across Elastic Security.
Help lead the team's technical direction.
Publish and present.
What You Bring6+ years of professional experience analyzing attacker tactics, techniques, and procedures (TTPs) and building detection methods for real security threats.6+ years of development experience in C, C++, and Python, with the judgment to write code that is safe, fast, and maintainable in a security-critical codebase.
Deep operating system internals knowledge, in both kernel and user mode, deep enough to reason about undocumented behavior and find security-relevant structures nobody has written about yet. Windows depth is what we need most, with macOS or Linux depth close behind.
In-depth reverse engineering and malware analysis experience, and comfort with the tooling that makes hard binaries readable.
An adversarial instinct. You anticipate how a protection will be evaded before it ships, and design for resilience rather than for the proof of concept in front of you.
A collaborative mentality and an eagerness to learn new skills, new platforms, and emerging technologies.
You have a proven track record of using AI to accelerate development, debug complex systems, and optimize code, while still owning the final outcomes.
You work autonomously and can drive decisions and results in a distributed team by leveraging asynchronous, direct, and transparent communication.
Passion for protecting the world's data from attackBonus PointsVulnerability research and exploit development, particularly with a track record of responsible disclosure to platform vendors.
Red teaming experience, or a background in building offensive tooling and defeating endpoint security products.
Kernel-mode development, including driver development and debugging.
Ownership or long-term maintenance of an open-source security tool with a real user base.
Conference speaking experience (e.g., Black Hat, DEF CON, CODE BLUE, Virus Bulletin) or an established publication record.
Experience applying machine learning to endpoint security problems.
Familiarity with the Elastic Stack (Elasticsearch, Kibana) and Elastic Security.
Compensation for this role is in the form of base salary. This role does not have a variable compensation component.
The typical starting salary range for new hires in this role is listed below. In select locations (including Seattle WA, Los Angeles CA, the San Francisco Bay Area CA, and the New York City Metro Area), an alternate range may apply as specified below.
These ranges represent the lowest to highest salary we reasonably and in good faith believe we would pay for this role at the time of this posting. We may ultimately pay more or less than the posted range, and the ranges may be modified in the future.
An employee's position within the salary range will be based on several factors including, but not limited to, relevant education, qualifications, certifications, experience, skills, geographi