Principal Security Researcher - XDR

Security represents the most critical priorities for our customers in a world awash in digital threats, regulatory scrutiny, and estate complexity. Microsoft Security aspires to make the world a safer place for all. We want to reshape security and empower every user, customer, and developer with a security cloud that protects them with end to end, simplified solutions. The Microsoft Security organization accelerates Microsoft’s mission and bold ambitions to ensure that our company and industry is securing digital technology platforms, devices, and clouds in our customers’ heterogeneous environments, as well as ensuring the security of our own internal estate. Our culture is centered on embracing a growth mindset, a theme of inspiring excellence, and encouraging teams and leaders to bring their best each day. In doing so, we create life-changing innovations that impact billions of lives around the world.

The Microsoft Extended Detection and Response (XDR) and Security Information and Event Management (SIEM) research team empowers security teams around the world to efficiently and effectively detect and respond to cyber-attacks. We achieve this by combining a deep understanding of threats- their objectives, tactics, and techniques; expert knowledge of the technologies that threats exploit; and fostering our researchers' curiosity and 'think like an attacker' mindset to constantly learn and adapt to a dynamic landscape. Security operation centers face a huge scale challenge where the difficulties of defending their environments increase over time while the resources available to them are always under threat. Our team leads the way in bringing Microsoft's security expertise to customers through AI technologies that quickly and automatically investigate and respond to both common and sophisticated threats. Our goal is to swiftly comprehend new and emerging threats, develop automated actions and investigation methods to protect customers all with a goal of helping security operations teams be as efficient as possible.

We are looking to hire a Principal Security Researcher who will drive the innovation of XDR-level automated attack disruption capabilities. You will leverage Microsoft’s security expertise and automation platforms to enhance and scale the defensive abilities of our customers and their security operations centers to counter the persistent threats they face.

Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

Responsibilities

Responsibilities:

• Help define and execute a security research agenda and vision that is at the forefront of automated attack disruption.
• Work with data from many different security domains across email, identity, endpoint, and cloud to build the most accurate and precise automated protection capabilities.
• Collaborate closely with partner engineering and product management teams to push the boundaries of innovation.
• Demonstrate leadership principles of model, coach, and care for team members.
• Foster diverse perspectives and inclusive behaviors.
• Embody our culture and values.
  
  

Qualifications

Qualifications - Required:

• 8+ years of computer security industry experience with knowledge of adversary tradecraft, security operations, incident response, threat hunting, and of emerging threats and techniques for attacks against modern enterprise environments. OR Doctorate in Statistics, Mathematics, Computer Science or related field
• 3+ years of experience designing, prototyping, and driving engineering requirements for threat protection systems.
• 2+ years of experience hunting for and investigating security incidents at scale with one or more of the following: Azure Synapse, Azure Data Lake, SQL, Cosmos, Kusto, or similar systems.
  
  

Other Requirements

• Experience within coding with languages such as C#, Python and/or PowerShell AND language independent data formats such as JSON/ YAML/XML.
• Experience applying MITRE ATT&CK to assess threat scenarios and protection coverage across both cloud and hybrid (cloud + on prem) attacks.
• Experience with endpoint, identity, cloud application, cloud infrastructure, email, network and/or other threat detection, and prevention technologies.
• Demonstrated experience in conducting data studies, including the ability to work with available telemetry and drive improvements with engineering teams for previously unexplored data sources.
• Experience with one or more of the following: Azure Functions, Azure Static Web Sites, Azure Containers, Azure DevOps pipelines, Github actions, Github Codespaces, and Jupyter Notebooks.
  
  

#MSFTSecurity #MSFTSecurity #MSFTSecurity

#Research_2024

Microsoft is an equal opportunity employer. Consistent with applicable law, all qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.