Senior Security Research Engineer

Description

The company makes search, security and observability software on a cloud platform, and more than 50% of the Fortune 500 use its platform. It combines search precision with AI and works across structured and unstructured data.

The Endpoint Protections team designs and builds the visibility and prevention features behind the company's endpoint and SIEM security product.

This senior research role leads work on new features that protect customers from the newest threats.

You will work alongside a wider security group of researchers, data scientists and engineers, each with deep knowledge in their field.

The team is spread across regions and values a positive, inclusive culture, clear communication, shared learning and mentoring.

In recent third-party enterprise testing, the product earned a perfect malware protection score with zero false alarms, ranking first in its field.

The team is growing.

Responsibilities

• Study real attacker tradecraft such as in-memory threats, injection, credential theft, ransomware and kernel tampering, then turn your findings into protections that hold up against an adversary trying to defeat them.
• Add endpoint telemetry on Windows, macOS and Linux, deepen the data already collected, and close the blind spots attackers depend on. Other teams will build on each new source.
• Write fast, stable C and C++ that runs on millions of endpoints, where a memory leak or a few milliseconds of overhead affects customers.
• Reverse engineer malware and learn how attackers get around endpoint controls in the wild, then apply that to the protections you design and harden.
• Own effectiveness after release. Review fleet telemetry at scale, investigate false positives and performance regressions, and set mitigation strategies. Shipping is the start of the job.
• Bring the depth built on Windows to macOS and Linux, and support new hardware architectures as enterprises adopt them.
• Write endpoint code with engineers in several countries and time zones, and work with the detection engineers, malware researchers and data scientists who depend on your telemetry.
• Help set the team's technical direction. Lead initiatives that span several releases, raise the standard in design and code reviews, and mentor engineers early in their careers.
• Publish research on the company's security research blog, present at conferences, and contribute to open source projects that many organizations rely on.

Requirements

• 6+ years of professional experience analyzing attacker tactics, techniques and procedures (TTPs) and building detection methods for real threats.
• 6+ years of development experience in C, C++ and Python, writing code that is safe, fast and maintainable in a security-critical codebase.
• Deep operating system internals knowledge in kernel and user mode, enough to reason about undocumented behavior and find security-relevant structures that are not yet documented. Windows is the priority, with macOS or Linux close behind.
• In-depth reverse engineering and malware analysis experience, along with skill in the tools that make hard binaries readable.
• An adversarial mindset: you predict how a protection will be evaded before it ships and design for resilience, not just for the proof of concept in front of you.
• A collaborative approach and a drive to learn new skills, platforms and emerging technologies.
• A proven record of using AI to speed up development, debug complex systems and optimize code, while owning the final results.
• You work independently, drive decisions and results in a distributed team, and communicate asynchronously, directly and transparently.
• A drive to keep the world's data safe from attackers.
• Bonus: vulnerability research and exploit development, ideally with a record of responsible disclosure to platform vendors.
• Bonus: red teaming or a background in building offensive tools and defeating endpoint security products.
• Bonus: kernel-mode development, including driver development and debugging.
• Bonus: ownership or long-term maintenance of an open-source security tool with a real user base.
• Bonus: conference talks (for example at Black Hat, DEF CON, CODE BLUE or Virus Bulletin) or an established publication record.
• Bonus: experience applying machine learning to endpoint security problems.
• Bonus: familiarity with the company's search and SIEM stack.

Conditions

Pay is base salary only, with no variable compensation component.

The typical starting salary range is $133,100 - $210,600 USD, or $159,900 - $252,900 USD in Seattle WA, Los Angeles CA, the San Francisco Bay Area CA and the New York City Metro Area.

These ranges reflect the lowest to highest pay the company reasonably and in good faith expects for this role at posting time, and actual pay may be above or below them and the ranges may change.

Placement within the range depends on education, qualifications, certifications, experience, skills, location, performance and business needs.

Pay is based on the work you do here, not on your previous salary.

Flexible locations and schedules are available for many roles.

Individuals located in or nationals of Belarus, Cuba, Iran, North Korea, Syria or Russia, including the annexed Ukrainian regions of Crimea, the DNR, the LNR, Kherson and Zaporizhzhia, may need an export license as a condition of employment, although national origin and nationality do not affect eligibility.

Benefits

• Eligibility for the company's stock program, in addition to cash pay.
• A company-matched 401k with dollar-for-dollar matching up to 6% of eligible earnings.
• Health coverage for you and your family in many locations.
• A generous number of vacation days each year.
• Matching of financial donations and service up to $2000 (or local currency equivalent).
• Up to 40 hours each year for volunteer projects you care about.
• At least 16 weeks of parental leave.
• A range of other well-being benefits, with a goal of parity across regions.