Back to jobs
New

Senior Manager, Endpoint Protections

United States

Elastic, the Search AI Company, enables everyone to find the answers they need in real time, using all their data, at scale — unleashing the potential of businesses and people. The Elastic Search AI Platform, used by more than 50% of the Fortune 500, brings together the precision of search and the intelligence of AI to enable everyone to accelerate the results that matter. By taking advantage of all structured and unstructured data — securing and protecting private information more effectively — Elastic’s complete, cloud-based solutions for search, security, and observability help organizations deliver on the promise of AI.

What is The Role

The Elastic Security Endpoint Protections team builds the visibility, prevention, and on-device machine learning capabilities at the core of Elastic Defend, our endpoint and SIEM security solution. We work in kernel and user mode across Windows, macOS, and Linux, against adversaries who study how to defeat what we build. Our work reaches the security community as well as the product, through original research and conference talks. We are looking for a Senior Manager who has done this work personally and can still review a design or write code. You will lead a globally distributed team and set the tone for a group that values candid feedback, collaborative learning, and mentorship.

We believe security is a team sport, and our efficacy is independently verified rather than simply claimed: in recent third-party enterprise protection testing, Elastic Security earned a perfect malware protection score with zero false alarms, the top result in the field. If you are energized by leading world-class engineers and making a measurable dent in how the industry defends the endpoint, we would love to hear from you!

What You Will Be Doing

  • Lead, mentor, and grow a world-class engineering team. Guide senior research engineers across endpoint internals, prevention engineering, and machine learning. Coach career development, deliver candid feedback, own the hiring pipeline, and set new engineers up to contribute quickly.
  • Own the roadmap and drive delivery. Decide where to invest in new visibility and where to deepen existing protection engines, balancing efficacy, performance, and stability across millions of endpoints. Work with product managers to define requirements and land high-quality features on release timelines.
  • Connect your team's work to the rest of Elastic Security. Every event source your team adds unlocks new detection and protection capabilities across the product. Invest in the joint planning, working relationships, and shared accountability that get your team's work into customers' hands.
  • Direct the team's machine learning work. Set direction on model development, training data quality, and the telemetry features those models depend on, and connect that work to the broader machine learning strategy across Elastic Security.
  • Drive cross-platform protection parity. Bring the depth Elastic has on Windows to macOS and Linux, keep the team ahead of new hardware architectures, and sustain the platform vendor relationships that give you early access to emerging operating system security APIs.
  • Represent the team externally. Support your engineers in presenting at conferences and publishing on Elastic Security Labs, engage with customers and partners on protection capabilities, and be a credible voice for Elastic in the endpoint security community.

What You Bring

  • People-leadership experience managing senior technical individual contributors on a globally distributed team. You lead with curiosity rather than authority, actively solicit feedback, and have a track record of growing people, not just shipping releases.
  • You have been a practitioner. Substantial hands-on experience as a security researcher before moving into leadership: analyzing attacker tactics, techniques, and procedures (TTPs), building the protections that counter them, and shipping into software that runs on customer machines at scale.
  • Operating system internals knowledge, in both kernel and user mode, earned hands-on rather than through oversight, and deep enough to reason about undocumented behavior and challenge a design on its technical merits. Windows depth is what we need most, with macOS or Linux close behind.
  • Hands-on reverse engineering and malware analysis experience. You have done this work yourself, and can still read a disassembly, assess a research finding on its merits, and judge which threats warrant investment.
  • An adversarial instinct. You anticipate how a protection will be evaded before it ships, and hold the team to designing for resilience rather than for the proof of concept in front of them.
  • Clear communication skills, comfortable writing for technical and executive audiences and distilling deeply technical work for non-expert stakeholders.
  • Motivation to thrive in a distributed, autonomous environment, with a genuine passion for protecting customers from real-world adversaries.
  • Demonstrated experience leveraging AI-assisted development tools to accelerate feature development, debug complex systems, and optimize existing codebases.
  • You possess the ability to comfortably rotate across projects, collaborate across functions and teams, and seamlessly adapt to evolving team structures.

Bonus Points

  • Prior ownership of an EDR, EPP, or other endpoint security product.
  • Personal research output: published vulnerabilities, patents, in-depth technical writing, or conference talks.
  • Experience leading machine learning engineers working on security problems.
  • Experience partnering with product engineering teams to take research prototypes through to GA release.
  • Conference speaking experience (e.g., Black Hat, DEF CON, CODE BLUE, Virus Bulletin).
  • Familiarity with the Elastic Stack (Elasticsearch, Kibana) and Elastic Security.

Additional Information - We Take Care of Our People

As a distributed company, diversity drives our identity. Whether you’re looking to launch a new career or grow an existing one, Elastic is the type of company where you can balance great work with great life. Your age is only a number. It doesn’t matter if you’re just out of college or your children are; we need you for what you can do.

We strive to have parity of benefits across regions and while regulations differ from place to place, we believe taking care of our people is the right thing to do.

  • Competitive pay based on the work you do here and not your previous salary
  • Health coverage for you and your family in many locations
  • Ability to craft your calendar with flexible locations and schedules for many roles
  • Generous number of vacation days each year
  • Increase your impact - We match up to $2000 (or local currency equivalent) for financial donations and service
  • Up to 40 hours each year to use toward volunteer projects you love
  • Embracing parenthood with minimum of 16 weeks of parental leave

Different people approach problems differently. We need that. Elastic is an equal opportunity/affirmative action employer committed to diversity, equity, and inclusion. Qualified applicants will receive consideration for employment without regard to race, ethnicity, color, religion, sex, pregnancy, sexual orientation, gender perception or identity, national origin, age, marital status, protected veteran status, disability status, or any other basis protected by federal, state or local law, ordinance or regulation.

We welcome individuals with disabilities and strive to create an accessible and inclusive experience for all individuals. To request an accommodation during the application or the recruiting process, please email candidate_accessibility@elastic.co We will reply to your request within 24 business hours of submission.

Applicants have rights under Federal Employment Laws, view posters linked below: Family and Medical Leave Act (FMLA) Poster; Pay Transparency Nondiscrimination Provision Poster; Employee Polygraph Protection Act (EPPA) Poster and Know Your Rights (Poster)

Elasticsearch develops and distributes encryption software and technology that is subject to U.S. export controls and licensing requirements for individuals who are located in or are nationals of the following sanctioned countries and regions: Belarus, Cuba, Iran, North Korea, Russia, Syria, the Crimea Region of Ukraine, the Donetsk People’s Republic (“DNR”), and the Luhansk People’s Republic (“LNR”). If you are located in or are a national of one of the listed countries or regions, an export license may be required as a condition of your employment in this role. Please note that national origin and/or nationality do not affect eligibility for employment with Elastic.

Please see here for our Privacy Statement.

Apply for this job

*

indicates a required field

Resume/CV*

Accepted file types: pdf, doc, docx, txt, rtf

Cover Letter

Accepted file types: pdf, doc, docx, txt, rtf

Education

Select...
Select...
Select...
Select...
Select...
Select...
Select...
Select...
How should we communicate with you? *

Select all that apply.

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiring process or thereafter. Any information that you do provide will be recorded and maintained in a confidential file.

As set forth in Referral Board’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.

Select...
Select...
Race & Ethnicity Definitions

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measure the effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categories is as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.

Select...

Voluntary Self-Identification of Disability

Form CC-305
Page 1 of 1
OMB Control Number 1250-0005
Expires 04/30/2026

Why are you being asked to complete this form?

We are a federal contractor or subcontractor. The law requires us to provide equal employment opportunity to qualified people with disabilities. We have a goal of having at least 7% of our workers as people with disabilities. The law says we must measure our progress towards this goal. To do this, we must ask applicants and employees if they have a disability or have ever had one. People can become disabled, so we need to ask this question at least every five years.

Completing this form is voluntary, and we hope that you will choose to do so. Your answer is confidential. No one who makes hiring decisions will see it. Your decision to complete the form and your answer will not harm you in any way. If you want to learn more about the law or this form, visit the U.S. Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) website at www.dol.gov/ofccp.

How do you know if you have a disability?

A disability is a condition that substantially limits one or more of your “major life activities.” If you have or have ever had such a condition, you are a person with a disability. Disabilities include, but are not limited to:

  • Alcohol or other substance use disorder (not currently using drugs illegally)
  • Autoimmune disorder, for example, lupus, fibromyalgia, rheumatoid arthritis, HIV/AIDS
  • Blind or low vision
  • Cancer (past or present)
  • Cardiovascular or heart disease
  • Celiac disease
  • Cerebral palsy
  • Deaf or serious difficulty hearing
  • Diabetes
  • Disfigurement, for example, disfigurement caused by burns, wounds, accidents, or congenital disorders
  • Epilepsy or other seizure disorder
  • Gastrointestinal disorders, for example, Crohn's Disease, irritable bowel syndrome
  • Intellectual or developmental disability
  • Mental health conditions, for example, depression, bipolar disorder, anxiety disorder, schizophrenia, PTSD
  • Missing limbs or partially missing limbs
  • Mobility impairment, benefiting from the use of a wheelchair, scooter, walker, leg brace(s) and/or other supports
  • Nervous system condition, for example, migraine headaches, Parkinson’s disease, multiple sclerosis (MS)
  • Neurodivergence, for example, attention-deficit/hyperactivity disorder (ADHD), autism spectrum disorder, dyslexia, dyspraxia, other learning disabilities
  • Partial or complete paralysis (any cause)
  • Pulmonary or respiratory conditions, for example, tuberculosis, asthma, emphysema
  • Short stature (dwarfism)
  • Traumatic brain injury
Select...

PUBLIC BURDEN STATEMENT: According to the Paperwork Reduction Act of 1995 no persons are required to respond to a collection of information unless such collection displays a valid OMB control number. This survey should take about 5 minutes to complete.