# Senior Security Research Engineer, SONAR (Security Operations and Novel Adversary Research) at Elastic

- Company: Elastic
- What the company does: Power insights and outcomes with The Elasticsearch Platform. See into your data and find answers that matter with enterprise solutions designed to help you accelerate time to insight. Try Elastic toda... Backed by NEA and Amplify.
- Company website: https://www.elastic.co/
- Type: Startups
- Level: Senior
- Location: United States
- Work setup: On-site
- Posted: 2026-08-27
- Apply by: 2026-10-14
- Apply: https://jobs.elastic.co/jobs?gh_jid=8161935&gh_jid=8161935
- Page: https://www.1752.vc/careers/jobs/elastic-senior-security-research-engineer-sonar-security-operations-and-novel-ad/

## About the role

SONAR is the adversary research team within Elastic Security. We discover novel adversary behavior through malware reverse engineering, threat hunting, and vulnerability research, turn every discovery into protections that ship to customers, and share our work publicly through Elastic Security Labs. We want to make environments hostile to adversaries, and to put rare knowledge and tooling within reach of every defender.

## What they're looking for

- Python development experience for research tooling and automation, plus the ability to read C and C++. Malware arrives in Rust, Go, and NodeJS too, so you are willing to learn a new runtime when a sample demands it
- YARA authorship and hunting at scale. You write signatures that hold up against the next variant, and you can find a weak signal in a very large telemetry dataset
- Working knowledge of the fundamentals : Windows and Linux internals, network protocols including HTTP and TLS, and enough applied cryptography to recognize what is protecting a configuration blob
- Technical writing ability. You can turn a long investigation into a clear, public analysis that other defenders can act on
- You have a proven track record of using AI to accelerate development, debug complex systems, and optimize code, while still owning the final outcomes
- Proven ability to seamlessly transition between different projects, codebases, or scrum teams based on dynamic business priorities

Tags: Security - Protections