Join Elastic's Security EDR Workflows team to implement user-facing features and architectures for Elastic Defend and OSquery forensics, write production-grade code (TypeScript/Node.js and potentially other languages), collaborate with cross-functional and global teams, and apply AI-assisted development practices. Experience with Elastic Stack, cybersecurity/forensics, and open-source contributions are listed as bonuses.

Work on designing and implementing user-facing workflows and APIs that interact with Elastic Defend to detect and respond to threats. Responsibilities include building scalable, high-performance systems, owning reliability and observability, writing production-grade TypeScript/Node.js code, collaborating across security, product, and design teams, and leveraging AI to improve engineering practices.

Work on Elastic's Security EDR Workflows team to design and implement Elastic Defend management and response-action capabilities, OSquery forensics, and APIs. Responsibilities include building scalable, high-performance systems, owning reliability and observability, writing production-grade TypeScript/Node.js code, collaborating across security, product, and design teams, and using AI to improve development. Compensation listed as CAD 128,300–203,000 (base).

Join the Security EDR Workflows team to develop Elastic Defend policy, management and response-action features, collaborate with security engineering, product and design, and deliver scalable, high-performance systems using TypeScript/Node.js (and potentially other languages). Role involves OSquery forensics, Kibana integration, use of AI in development, and working with a globally distributed team. Location: Spain. Typical starting salary range: €55,800–€88,300 per year.

Work on Elastic's Security EDR Workflows team to design and implement policy configuration, response actions, and OSquery forensics capabilities for Elastic Defend. Implement user-facing features and scalable back-end systems using TypeScript/Node.js (and potentially other languages), collaborate with cross-functional and distributed teams, and apply AI-assisted development practices.

Join Elastic’s Security EDR Workflows team to implement user-facing workflows and management features for Elastic Defend, build response-actions and OSquery forensics, and develop scalable, high-performance systems. The role involves writing production-grade code (TypeScript/Node.js), collaborating with cross-functional and distributed teams, and using AI to improve development and engineering processes.

Join the Security EDR Workflows team to develop Elastic Defend management and response-action capabilities, OSquery forensics, and related workflows from the Kibana/UI side. Work involves writing production-grade code (TypeScript/Node.js and potentially other languages), contributing to architecture and scalable systems, collaborating across distributed security and product teams, and using AI to support development. Location: Ireland. Typical starting salary range: €72,800–€115,100 EUR per year.

Join Elastic's Security EDR Workflows team to implement user-facing features and backend frameworks for Elastic Defend and OSquery-based forensics. Work with TypeScript/Node.js (and potentially other languages), collaborate across security, product and design teams, and apply AI-assisted development to deliver scalable, high-performance security features used by practitioners worldwide.

Lead end-to-end delivery of Elastic Security projects (design, deploy, migrate) for customers including public sector, assess architectures and threat landscapes, build detections and ingestion pipelines, enable detection-as-code and Agentic AI features, collaborate with Sales/Engineering, and mentor other consultants. Requires 5+ years' experience, strong Elastic/SIEM and security expertise, scripting (Python), cloud and OS experience, and eligibility for national security screening where needed.

Elastic is hiring a Senior Solutions Architect focused on SIEM and security to architect and implement Elastic Security solutions, run proof-of-value projects, support consultative sales (RFI/RFP, presentations), and improve incident response and SOC operations. The role expects 10+ years of enterprise SIEM experience, expertise in security analytics, AI/ML techniques applied to security, and includes travel of 30–50%. Typical OTE range: €110,400–€174,600.

Work includes reverse engineering obfuscated and packed malware across Windows, macOS, and Linux; operating large-scale telemetry systems to surface campaigns; authoring signatures and automation to ship protections; publishing public research; and mentoring and setting technical direction. Requires 6+ years of professional malware reverse engineering experience, Python development, YARA authorship, and working knowledge of OS internals, network protocols, and applied cryptography.

Join Elastic Security Endpoint Protections to research emerging attacker techniques and convert them into shipped protections. Responsibilities include instrumentation of endpoint telemetry, developing performant C/C++ production code for millions of endpoints, reverse engineering malware, owning efficacy end-to-end, extending protections across platforms, collaborating across distributed teams, mentoring, and publishing research. Requires 6+ years analyzing TTPs and building detections, 6+ years development in C/C++/Python, deep OS internals knowledge (Windows prioritized), and malware analysis experience.

Role requires 6+ years experience in attacker TTP analysis and building detections, 6+ years development in C, C++, and Python, deep OS internals and reverse-engineering skills, and experience developing performant, stable endpoint protections. Responsibilities include researching threats, adding endpoint visibility, writing production code, investigating telemetry at fleet scale, extending protections across platforms, mentoring, and publishing research. Salary range provided in CAD.

Lead and grow a distributed engineering team focused on endpoint protections (visibility, prevention, on-device ML) for Elastic Defend. Responsibilities include mentoring senior engineers, owning the roadmap and delivery, directing ML model work and telemetry, driving cross-platform protection parity (Windows, macOS, Linux), and representing the team in research and conferences. Requires hands-on security research, OS internals (kernel and user mode), malware analysis and reverse engineering experience, and people-leadership of senior technical contributors.

Senior Manager role responsible for leading and growing a globally distributed engineering team focused on endpoint protections (visibility, prevention, on-device machine learning) for Elastic Defend. The role requires hands-on background in security research, OS internals (kernel and user mode), reverse engineering and malware analysis, and experience mentoring senior engineers, owning roadmaps, and driving cross-platform protection parity. Compensation is base salary with a typical starting range of €80,400–€127,200 per year.

Role involves reverse engineering novel malware across Windows, macOS, and Linux; operating large-scale telemetry and data systems to surface threats; authoring signatures and automation to ship protections; publishing public research; collaborating with other security teams; and leading technical direction and mentorship. Requires 6+ years of relevant experience.

Elastic is hiring a Senior Security Research Engineer to research attacker techniques, build endpoint visibility and protections, reverse engineer malware, develop high-performance C/C++ production code, and lead technical initiatives. The role requires 6+ years of experience in TTP analysis and detection, development in C/C++/Python, deep OS internals knowledge (Windows prioritized), and malware/reverse-engineering expertise. Compensation is provided as base salary (USD range listed).

Elastic is hiring a Principal Product Manager to lead XDR end-to-end and expand it into exposure and vulnerability management. The role partners with engineering, Security Labs, and senior customer stakeholders to prioritize exposures, define requirements, and deliver roadmap direction. Requires 7–10 years of product management experience with at least 4 years in security or B2B enterprise software. Typical starting salary range: €88,400–€118,800 EUR per year.

Remote-first Principal Product Manager role focused on managing and prioritizing enhancement requests from Elastic Security’s most strategic enterprise accounts, translating customer needs into shipped product, influencing core roadmaps, and working across Product, Sales, Customer Success, Engineering, and Legal. Requires ~7+ years product management experience (7–10 years noted), deep security domain knowledge (SIEM, SOAR, XDR, detection engineering), executive communication, and up to 50% travel.

Deliver and architect Elastic solutions with a focus on security and SIEM use cases. Responsibilities include requirements gathering, solution design, hands-on deployment (data onboarding, configuration, visualizations, alerting), cluster tuning, integrations, capacity planning, audits and migrations, and customer-facing workshops. Requires experience with Elastic Security or similar SIEM tools, familiarity with MITRE ATT&CK, cloud platforms (AWS/Azure/GCP/OpenStack), Linux, networking, containerization, scripting (Python/JavaScript/Go) and strong stakeholder communication; willingness to travel occasionally.