{"id":583812,"url":"https://alion.io/job/elastic-dev-senior-security-research-engineer","title":"Senior Security Research Engineer","company":{"id":4819,"name":"Elastic","domain":"elastic.co","url":"https://alion.io/company/elastic","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":81,"open_postings":35,"ghost_share":0,"stale_share":0.743,"repost_share":0,"time_to_fill_p50_days":38,"computed_at":"2026-10-04T05:45:00Z"}},"role":"AI/ML","role_family":"AI/ML","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":133100,"max":210600,"currency":"USD","period":"year","gross":null,"usd_annual":210600},"salary_estimate":null,"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"C++","optional":false},{"name":"Elastic SIEM","optional":false},{"name":"ElasticSearch","optional":false},{"name":"Linux","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false},{"name":"Kibana","optional":true},{"name":"Machine Learning","optional":true},{"name":"Red Teaming","optional":true}],"status":"live","first_seen_at":"2026-08-10T16:52:39Z","employer_posted_date":"2026-09-11","last_verified_at":"2026-10-04T23:53:44Z","board_verified":true,"closed_at":null,"days_open":55,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":55},"description":"Elastic, the Search AI Company, enables everyone to find the answers they need in real time, using all their data, at scale - unleashing the potential of businesses and people. The Elastic Search AI Platform, used by more than 50% of the Fortune 500, brings together the precision of search and the intelligence of AI to enable everyone to accelerate the results that matter. By taking advantage of all structured and unstructured data - securing and protecting private information more effectively - Elastic’s complete, cloud-based solutions for search, security, and observability help organizations deliver on the promise of AI.\nWhat is The Role\nThe Elastic Security Endpoint Protections team researches, designs, and builds the visibility and prevention capabilities at the core of Elastic Defend, our endpoint and SIEM security solution. We are looking for a Senior Security Research Engineer to help lead our efforts to build innovative features that secure our users against the latest emerging threats. You will collaborate with the broader Elastic Security team, a diverse group of skilled researchers, data scientists, and engineers who bring deep domain knowledge in their respective areas. Our geographically dispersed team values positivity and inclusivity in the workplace, clear communication, collaborative learning, and guided mentorship.\nWe don't just claim our protections work. In recent third-party enterprise protection testing, Elastic Security earned a perfect malware protection score with zero false alarms, the top result in the field. If you have a passion for security research and would enjoy the challenge of devising novel methods for thwarting malicious actors in an ever-evolving threat landscape, join our growing team!\nWhat You Will Be Doing\nResearch emerging attacker techniques and turn them into shipped protections. Study real-world tradecraft across in-memory threats, injection, credential theft, ransomware, and kernel tampering, then design protections that hold up against an adversary actively trying to defeat them.\nBuild and extend endpoint visibility. Instrument new event sources across Windows, macOS, and Linux, deepen the telemetry we already collect, and close the gaps attackers rely on. Every source you add becomes a foundation for other teams.\nDevelop production code that runs everywhere. Write performant, stable C/C++ that executes on millions of endpoints, where a memory leak or a few milliseconds of overhead is a customer-visible problem.\nReverse engineer malware and study evasion. Learn how attackers bypass endpoint security controls in the wild, and feed that understanding directly into the protections you design and harden.\nOwn efficacy end to end. Review customer telemetry at fleet scale, investigate false positives and performance regressions, and establish mitigation strategies. Shipping the feature is the beginning of the job, not the end.\nExtend protection parity across platforms. Bring the depth we have on Windows to macOS and Linux, and support new hardware architectures as they reach the enterprise.\nCollaborate across Elastic Security. Implement endpoint code alongside peers in multiple countries and time zones, and work with the detection engineers, malware researchers, and data scientists who rely on your telemetry.\nHelp lead the team's technical direction. Take point on initiatives that span multiple releases, raise the bar in design and code reviews, and mentor engineers earlier in their careers.\nPublish and present. Share your research on Elastic Security Labs, present at conferences, and contribute to the open source projects that organizations around the world rely on.\nWhat You Bring\n 6+ years of professional experience analyzing attacker tactics, techniques, and procedures (TTPs) and building detection methods for real security threats.\n6+ years of development experience in C, C++, and Python, with the judgment to write code that is safe, fast, and maintainable in a security-critical codebase.\nDeep operating system internals knowledge, in both kernel and user mode, deep enough to reason about undocumented behavior and find security-relevant structures nobody has written about yet. Windows depth is what we need most, with macOS or Linux depth close behind.\nIn-depth reverse engineering and malware analysis experience, and comfort with the tooling that makes hard binaries readable.\nAn adversarial instinct. You anticipate how a protection will be evaded before it ships, and design for resilience rather than for the proof of concept in front of you.\nA collaborative mentality and an eagerness to learn new skills, new platforms, and emerging technologies.\nYou have a proven track record of using AI to accelerate development, debug complex systems, and optimize code, while still owning the final outcomes.\nYou work autonomously and can drive decisions and results in a distributed team by leveraging asynchronous, direct, and transparent communication.\n Passion for protecting the world's data from attack!\nBonus Points\nVulnerability research and exploit development, particularly with a track record of responsible disclosure to platform vendors.\nRed teaming experience, or a background in building offensive tooling and defeating endpoint security products.\nKernel-mode development, including driver development and debugging.\nOwnership or long-term maintenance of an open-source security tool with a real user base.\nConference speaking experience (e.g., Black Hat, DEF CON, CODE BLUE, Virus Bulletin) or an established publication record.\nExperience applying machine learning to endpoint security problems.\nFamiliarity with the Elastic Stack (Elasticsearch, Kibana) and Elastic Security.\nCompensation for this role is in the form of base salary. This role does not have a variable compensation component. \nThe typical starting salary range for new hires in this role is listed below. In select locations (including Seattle WA, Los Angeles CA, the San Francisco Bay Area CA, and the New York City Metro Area), an alternate range may apply as specified below. \nThese ranges represent the lowest to highest salary we reasonably and in good faith believe we would pay for this role at the time of this posting. We may ultimately pay more or less than the posted range, and the ranges may be modified in the future. \nAn employee's position within the salary range will be based on several factors including, but not limited to, relevant education, qualifications, certifications, experience, skills, geographic location, performance, and business or organizational needs.\nElastic believes that employees should have the opportunity to share in the value that we create together for our shareholders. Therefore, in addition to cash compensation, this role is currently eligible to participate in Elastic's stock program. Our total rewards package also includes a company-matched 401k with dollar-for-dollar matching up to 6% of eligible earnings, along with a range of other benefits offered with a holistic emphasis on employee well-being.\nThe typical starting salary range for this role is:\n$133,100—$210,600 USD\nThe typical starting salary range for this role in the select locations listed above is:\n$159,900—$252,900 USD\nAdditional Information - We Take Care of Our People\nAs a distributed company, diversity drives our identity. Whether you’re looking to launch a new career or grow an existing one, Elastic is the type of company where you can balance great work with great life. Your age is only a number. It doesn’t matter if you’re just out of college or your children are; we need you for what you can do.\nWe strive to have parity of benefits across regions and while regulations differ from place to place, we believe taking care of our people is the right thing to do.\nCompetitive pay based on the work you do here and not your previous salary\nHealth coverage for you and your family in many locations\nAbility to craft your calendar with flexible locations and schedules for many roles\nGenerous number of vacation days each year\nIncrease your impact - We match up to $2000 (or local currency equivalent) for financial donations and service\nUp to 40 hours each year to use toward volunteer projects you love\nEmbracing parenthood with minimum of 16 weeks of parental leave\nDifferent people approach problems differently. We need that. Elastic is an equal opportunity employer and is committed to creating an inclusive culture that celebrates different perspectives, experiences, and backgrounds. Qualified applicants will receive consideration for employment without regard to race, ethnicity, color, religion, sex, pregnancy, sexual orientation, gender perception or identity, national origin, age, marital status, protected veteran status, disability status, or any other basis protected by federal, state or local law, ordinance or regulation.\nWe welcome individuals with disabilities and strive to create an accessible and inclusive experience for all individuals. To request an accommodation during the application or the recruiting process, please email . We will reply to your request within 24 business hours of submission.\nApplicants have rights under Federal Employment Laws, view posters linked below: Family and Medical Leave Act (FMLA) Poster; Pay Transparency Nondiscrimination Provision Poster; Employee Polygraph Protection Act (EPPA) Poster and Know Your Rights (Poster)\nElasticsearch develops and distributes technology and information that is subject to U.S. and other countries’ export controls and licensing requirements for individuals who are located in or are nationals of the following sanctioned countries and regions: Belarus, Cuba, Iran, North Korea, Syria, or Russia, including the Ukrainian territories annexed by Russia (The Crimea region of Ukraine, The Donetsk People's Republic (DNR), The Luhansk People's Republic (LNR), Kherson or Zaporizhzhia). If you are located in or are a national of one of the listed countries or regions, an export license may be required as a condition of your employment in this role. Please note that national origin and/or nationality do not affect eligibility for employment with Elastic.\nPlease see here for our Privacy Statement.","description_format":"text","description_chars":10258,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Parental leave"],"hiring_locations":[{"name":"Belarus","iso":"BY","kind":"country"},{"name":"Cuba","iso":"CU","kind":"country"},{"name":"Iran","iso":"IR","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Endpoint Security","Security Operations","Observability & APM"],"lifecycle":[{"event":"open","at":"2026-09-10T00:59:52Z"}],"visa":[],"liveness":{"score":22,"band":"cold","label":"Long shot","p_open":1,"p_active":0.501,"p_room":0.44,"age_days":54,"expected_fill_days":38,"reasons":["conf:0","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-04T05:45:00Z"},"pay":{"stated_usd_annual":210600,"is_top_pay":true},"html_url":"https://alion.io/job/elastic-dev-senior-security-research-engineer","json_url":"https://alion.io/job/elastic-dev-senior-security-research-engineer.json","meta":{"generated_at":"2026-10-05T01:38:03Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":2171,"day_limit":5000,"remaining_today":2829,"minute_limit":60,"resets_at":"2026-10-06T00:00:00Z"}}}