Senior Security Research Engineer

About the role

Elastic's Security Endpoint Protections team researches, designs and builds the visibility and prevention capabilities at the core of Elastic Defend, its endpoint and SIEM security solution. The Senior Security Research Engineer leads the effort to build innovative features that protect users against emerging threats, working with a geographically dispersed team of researchers, data scientists and engineers.

Key responsibilities

• Research emerging attacker techniques and turn them into shipped protections, covering in-memory threats, injection, credential theft, ransomware and kernel tampering.
• Build and extend endpoint visibility by instrumenting new event sources on Windows, macOS and Linux and closing telemetry gaps.
• Write performant, stable C/C++ code that runs on millions of endpoints.
• Reverse engineer malware and study evasion, then feed that understanding into the protections designed.
• Review customer telemetry at fleet scale, investigate false positives and performance regressions, and set mitigation strategies.
• Bring the depth of Windows protection to macOS and Linux and support new hardware architectures.
• Implement endpoint code with peers in multiple countries and time zones, and work with detection engineers, malware researchers and data scientists.
• Help lead the team's technical direction, mentor engineers and publish research on Elastic Security Labs, at conferences and in open source projects.

Required profile

• 6+ years of experience analyzing attacker TTPs and building detection methods for real threats.
• 6+ years of development experience in C, C++ and Python, writing safe, fast and maintainable code in a security-critical codebase.
• Deep knowledge of OS internals in kernel and user mode, with strong Windows depth and macOS or Linux depth close behind.
• In-depth reverse engineering and malware analysis experience.
• Proven track record of using AI to accelerate development, debug complex systems and optimize code.
• Comfortable working autonomously in a distributed team through asynchronous, direct and transparent communication.

Required skills

• C, C++ and Python
• Reverse engineering and malware analysis
• Bonus: vulnerability research and exploit development, red teaming, kernel-mode development, open-source tool ownership, conference speaking, machine learning for endpoint security, and familiarity with the Elastic Stack (Elasticsearch, Kibana) and Elastic Security.

What we offer

• Base salary of EUR 67,000 to 106,000, with no variable component.
• Health coverage for you and your family in many locations.
• Flexible locations and schedules for many roles, generous vacation days.
• Volunteer time off and parental leave of at least 16 weeks.