Senior Malware Research Engineer - Threat Hunting & AI

Elastic; United States; On-site; USD 140,000 - 200,000; Full time

Job summary

Elastic Security is seeking a Senior Security Research Engineer to take on our hardest analysis work, reverse engineer malware, and help set the team’s technical direction. We value collaboration and public research, with mentorship and shared threat intelligence across teams.

You will publish findings, contribute detection artifacts, and build scalable protections while advancing adversary research across platforms and architectures.

Qualifications

• 6+ years reverse engineering malware across multiple formats and architectures.
• Proficiency in Python for research tooling and automation; reading C/C++.
• YARA authorship and threat hunting at scale.
• Fundamentals of Windows/Linux internals and network protocols.
• Technical writing to deliver clear, public analyses.
• Experience using AI to accelerate development and investigations.

Responsibilities

• Reverse engineer malware across Windows, macOS, Linux and recover communication and configuration.
• Operate data systems to surface threats from millions of endpoints and provide context.
• Create protections, write signatures, and build scalable tooling and automation.
• Publish research and contribute artifacts to public repositories and conferences.
• Collaborate with Elastic Security and mentor junior researchers.
• Help set technical direction and lead investigations that span months.

Skills

Reverse engineering

Python

C/C++ reading

YARA

Windows internals

Linux internals

Network protocols

Cryptography basics

Technical writing

AI-assisted tooling

Collaboration

Job description

Elastic Security is seeking a Senior Security Research Engineer to take on our hardest analysis work, reverse engineer malware, and help set the team’s technical direction. We value collaboration and public research, with mentorship and shared threat intelligence across teams.

You will publish findings, contribute detection artifacts, and build scalable protections while advancing adversary research across platforms and architectures.