Senior Security Research Engineer, SONAR

About the role

Elastic's SONAR team is its adversary research group, which discovers novel adversary behaviour through malware reverse engineering, threat hunting and vulnerability research, turns every discovery into customer-facing protections and shares its work publicly through Elastic Security Labs. The team is geographically dispersed and values positivity, inclusivity, clear communication, collaborative learning and guided mentorship. The Senior Security Research Engineer takes on the hardest analysis work and helps set the technical direction of the team.

Key responsibilities

• Reverse engineer undocumented malware, unpacking obfuscated and packed samples across Windows, macOS and Linux to understand how they communicate, configure themselves and hide.
• Use global data systems to identify and mitigate threats, working through data from millions of endpoints to surface the activity worth investigating and build campaign context for customers.
• Turn every discovery into a shipped protection: author signatures and build automation and AI-assisted workflows that speed up future investigations.
• Publish on Elastic Security Labs, release tools and detection artifacts to public GitHub repositories and present at conferences.
• Work with neighbouring Elastic Security teams on shared threat intelligence and detection engineering projects.
• Help lead the team's technical direction, take point on long-running investigations, raise the bar in reviews and mentor early-career researchers.

Required profile

• 6+ years of professional experience reverse engineering malware and researching adversary tradecraft, static and dynamic, across PE, ELF and Mach-O formats and x86-64 and ARM architectures.
• Experience with obfuscated and packed code that defeats automated tooling.
• Technical writing ability to turn long investigations into clear, public analyses.
• Proven track record of using AI to accelerate development, debug complex systems and optimise code.
• Ability to move between projects, codebases or scrum teams as business priorities change.

Required skills

• Python for research tooling and automation, plus the ability to read C and C++ and learn Rust, Go and Node.js when needed.
• YARA authorship and large-scale threat hunting.
• Windows and Linux internals, HTTP and TLS, and applied cryptography.
• Bonus points: vulnerability research with responsible disclosure, CTF participation, open-source tool maintenance, conference talks, attribution tradecraft, behavioural detection or machine learning for malware classification, and familiarity with the Elastic Stack and Elastic Security.

What we offer

• Base salary of EUR 67,000 to 106,000, with no variable component.
• Flexible locations and schedules, generous vacation days and parental leave of at least 16 weeks.
• Health coverage for you and your family in many locations.
• Matching of up to $2,000 for donations and service, and up to 40 hours per year for volunteering.