Senior Malware Threat Research Engineer

Elastic; España; On-site; EUR 115,000 - 181,000; Full time

Benefits offered by this job

Health coverage

Flexible work locations

Generous vacation days

Donation matching

Job summary

Elastic is hiring a Senior Security Research Engineer for the SONAR adversary research team. You will reverse engineer malware across Windows, macOS, and Linux, uncovering stealthy configurations and communication patterns. You will build scalable protections, signatures, and AI-assisted workflows for rapid investigations.

You will publish findings to Elastic Security Labs, contribute to public repos, and collaborate across Elastic Security to raise the detection bar and mentor newer researchers.

Qualifications

• 6+ years reverse engineering malware and researching adversary tradecraft across PE/ELF/Mach-O formats.
• Python for research tooling and automation; ability to read C/C++.
• YARA authorship and hunting at scale on large telemetry datasets.

Responsibilities

• Reverse engineer malware across Windows, macOS, Linux; analyze behavior and communication.
• Operate global data systems to surface threat activity and context.
• Develop protections, signatures, and scalable automation/AI-assisted workflows.
• Publish research to Elastic Security Labs and public repositories; present at conferences.
• Collaborate with Elastic Security teams on threat intelligence and detection projects.
• Lead investigations and mentor junior researchers.

Skills

Malware reverse engineering

Python for tooling

YARA signatures

Windows/Linux internals

Cryptography basics

Technical writing

AI-enabled development

Tools

GitHub

MISP

OpenCTI

Elastic Stack

Git

Job description

Elastic is hiring a Senior Security Research Engineer for the SONAR adversary research team. You will reverse engineer malware across Windows, macOS, and Linux, uncovering stealthy configurations and communication patterns. You will build scalable protections, signatures, and AI-assisted workflows for rapid investigations.

You will publish findings to Elastic Security Labs, contribute to public repos, and collaborate across Elastic Security to raise the detection bar and mentor newer researchers.