Senior Endpoint Security Research Engineer

Elastic; Ireland; Remote; EUR 67,000 - 106,000; Full time

Benefits offered by this job

Health coverage

Flexible locations & schedules

Generous vacation days

Volunteer days

Parental leave

Job summary

Elastic is seeking a Senior Security Research Engineer to lead efforts in building protections for Elastic Defend. You will research attacker techniques, design end-to-end protections, and develop production-grade code for Windows, macOS, and Linux across a distributed team.

The role emphasizes malware analysis, OS internals knowledge, and collaboration with data scientists and engineers to counter evolving threats and improve telemetry and detection capabilities.

Qualifications

• 6+ years building detection methods for real threats.
• Deep OS internals knowledge (Windows core depth preferred).
• Experience in reverse engineering malware and malware analysis.

Responsibilities

• Research attacker techniques and turn them into protections.
• Extend endpoint visibility across Windows, macOS, Linux; broaden telemetry.
• Develop production code in C/C++ that runs on millions of endpoints.
• Reverse engineer malware and study evasion strategies.
• Own efficacy end to end: review telemetry, false positives, and performance.
• Extend protection parity across platforms and new hardware architectures.
• Collaborate across Elastic Security with cross-country teams.
• Lead technical direction on multi-release initiatives and code reviews.
• Publish and present research through Elastic Security Labs and conferences.

Skills

TTP analysis

Security research

C/C++ & Python

OS internals (Windows)

Reverse engineering

Adversarial thinking

Collaborative work

AI-assisted development

Threat hunting

Tools

C

C++

Python

Reverse engineering tooling

Debugging tools

Job description

Elastic is seeking a Senior Security Research Engineer to lead efforts in building protections for Elastic Defend. You will research attacker techniques, design end-to-end protections, and develop production-grade code for Windows, macOS, and Linux across a distributed team.

The role emphasizes malware analysis, OS internals knowledge, and collaboration with data scientists and engineers to counter evolving threats and improve telemetry and detection capabilities.