9 days ago
Canada (city not specified)Senior
Responsibilities
- Research emerging attacker techniques involving in-memory threats, injection, credential theft, ransomware, and kernel tampering and convert findings into shipped protections.
- Build endpoint visibility by instrumenting event sources and expanding telemetry across Windows, macOS, and Linux.
- Develop performant, stable production code in C and C++ for deployment across millions of endpoints.
- Reverse engineer malware, study evasion techniques, and harden endpoint security controls.
- Review customer telemetry, investigate false positives and performance regressions, and establish mitigation strategies.
- Extend protection parity across operating systems and support new hardware architectures.
- Collaborate with detection engineers, malware researchers, data scientists, and distributed engineering teams.
- Lead multi-release technical initiatives, participate in design and code reviews, and mentor earlier-career engineers.
- Publish research, present at conferences, and contribute to open-source security projects.
Requirements
- At least 6 years of professional experience analyzing attacker tactics, techniques, and procedures and building detection methods for real security threats.
- At least 6 years of development experience in C, C++, and Python.
- Deep knowledge of operating-system internals in kernel and user mode, especially Windows, with macOS or Linux expertise preferred.
- In-depth reverse-engineering and malware-analysis experience.
- Ability to anticipate evasion techniques and design resilient security protections.
- Ability to work autonomously and make decisions in a distributed, asynchronous team.
- Demonstrated use of AI to accelerate development, debug complex systems, and optimize code while owning final outcomes.
- Preferred qualifications include vulnerability research, exploit development, red teaming, offensive-tool development, kernel-mode or driver development, open-source security-tool maintenance, conference speaking, publication experience, machine learning applied to endpoint security, and familiarity with Elasticsearch, Kibana, and Elastic Security.
Benefits
- Base salary with no variable compensation component, plus eligibility for Elastic's stock program.
- Company-matched Registered Retirement Savings Plan with dollar-for-dollar matching up to 6% of eligible earnings.
- Health coverage for employees and families in many locations.
- Distributed work with flexible locations and schedules for many roles.
- Generous vacation time and at least 16 weeks of parental leave.
- Up to $2,000 in matched financial donations and up to 40 hours annually for volunteer projects.
- Inclusive equal-opportunity workplace with accessibility accommodations available.
About Elastic
Elastic builds the Elasticsearch-based platform for enterprise search, observability (logging, metrics, APM), and security (SIEM/endpoint). It sells subscriptions and Elastic Cloud managed services with usage-based pricing, combining open source and proprietary features through Elasticsearch and Kibana. Founded in 2012 and headquartered in San Francisco, Elastic is publicly traded on the NYSE and is used by more than half of the Fortune 500.