Senior Security Research Engineer, SONAR (Security Operations and Novel Adversary Research)
Elastic · United States
About this role
## Senior Security Research Engineer — SONAR (Security Operations and Novel Adversary Research) **Elastic, the Search AI Company** enables people to find answers in real time using all their data at scale. Elastic’s Search AI Platform (used by 50%+ of the Fortune 500) combines search precision with AI intelligence across **search, security, and observability**. ### What is the Role SONAR is Elastic Security’s adversary research team. They discover novel adversary behavior through **malware reverse engineering, threat hunting, and vulnerability research**, then turn findings into **protections shipped to customers** and share work publicly via **Elastic Security Labs**. The team aims to make environments hostile to adversaries and to put rare knowledge and tooling within reach of every defender. The role emphasizes positivity, inclusivity, clear communication, collaborative learning, and guided mentorship. ### What You Will Be Doing - **Reverse engineer malware nobody has documented yet**: analyze obfuscated/packed samples across **Windows, macOS, and Linux** to recover communication methods, configuration, and stealth behavior. - **Operate global data systems to identify and mitigate threats**: work with data from **millions of endpoints** to surface high-value activity, build campaign context for customers, and push mitigations across the fleet. - **Turn every discovery into shipped protection (and scalable tooling)**: author signatures to stop what you find, and build automation / AI-assisted workflows to speed up investigations. - **Build your public research reputation**: publish on Elastic Security Labs, release tools and detection artifacts to public GitHub repos, and present at conferences. - **Collaborate across Elastic Security**: your discoveries become rules and models for neighboring teams that ship protections. *Note: The provided job description appears truncated at the end of the last bullet.*
Listing freshness
CronJobs last confirmed this listing 8h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.