Senior Security Research Engineer, SONAR - Elastic

About the Role

SONAR is the adversary research team within Elastic Security. We discover novel adversary behavior through malware reverse engineering, threat hunting, and vulnerability research. We turn every discovery into protections that ship to customers and share our work publicly through Elastic Security Labs. We are looking for a Senior Security Research Engineer to take on our most complex analysis work and help set the technical direction of the team.

What You Will Be Doing

• Reverse Engineering: Analyze undocumented malware, including obfuscated and packed samples across Windows, macOS, and Linux.
• Threat Mitigation: Operate global data systems to identify threats, build campaign context, and push mitigations across the fleet.
• Protection Engineering: Author signatures and build automation/AI-assisted workflows to scale detection capabilities.
• Public Research: Publish findings on Elastic Security Labs, release tools on GitHub, and present at security conferences.
• Collaboration: Work across Elastic Security teams to integrate discoveries into rules and models.
• Leadership: Lead long-term investigations, perform code reviews, and mentor junior researchers.

What You Bring

• 6+ years of professional experience in malware reverse engineering and adversary tradecraft.
• Proficiency in static and dynamic analysis across multiple formats (PE, ELF, Mach-O) and architectures (x86-64, ARM).
• Strong Python development skills for research tooling; ability to read C and C++.
• Expertise in YARA authorship and hunting at scale.
• Solid understanding of Windows/Linux internals, network protocols (HTTP/TLS), and applied cryptography.
• Excellent technical writing skills for public-facing analysis.
• Experience using AI to accelerate development and debug complex systems.

Bonus Points

• Track record of vulnerability research and responsible disclosure.
• Participation in CTFs (e.g., FLARE-ON, NetWars).
• Established community standing (open-source tools, conference speaker).
• Experience with attribution tradecraft and platforms like MISP or OpenCTI.
• Knowledge of the Elastic Stack (Elasticsearch, Kibana).