Join Microsoft's Cloud Threat Protection Research team, at the forefront of safeguarding cloud and AI workloads at a global scale. Our research directly shapes the defenses within Microsoft Defender, where we investigate real-world attacker tactics, analyze critical incidents, and engineer robust protections for major enterprises, governments, and infrastructure worldwide. We tackle complex, high-impact security challenges rooted in the realities of modern cloud attacks and defenses.

Our team fosters a culture of trust and impact, offering researchers significant ownership, the freedom to innovate, and close collaboration with product and engineering teams. We are a collective of globally recognized cloud security researchers and AI experts, dedicated to continuous innovation and customer protection in a dynamic threat landscape. We value deep technical expertise, clear thinking, and empathy for our customers. Growth is actively supported through mentorship, leadership opportunities, patents, publications, and cross-team collaborations.

If you are driven by solving challenging security problems, making a tangible impact on production systems, and growing alongside talented peers, this is an environment where you can achieve your career best. Microsoft is committed to empowering every person and organization globally. We operate with a growth mindset, innovate to enable others, and collaborate to achieve shared objectives, building upon our values of respect, integrity, and accountability to cultivate an inclusive culture where everyone can excel.

Investigate sophisticated hybrid attacks that traverse cloud services, endpoints, identity systems, and AI platforms.

Analyze live attacker behaviors, production incidents, and customer feedback to develop high-fidelity detections and enhance existing ones.

Design and implement multi-cloud and enterprise-level defenses that are deployed at scale within Microsoft Defender.

Transform high-confidence threat research into automated attack disruption capabilities within Microsoft Defender to neutralize active threats in real-time.

Collaborate with internal AI teams to advance AI security, improve detection accuracy, and enhance explainability.

Develop innovative tools, automation solutions, and research prototypes capable of global scalability.

Partner closely with product, engineering, and global research teams to translate research insights into measurable impact.

A minimum of 8 years of experience in cybersecurity, including a strong, hands-on understanding of the modern attacker kill chain, the MITRE ATT&CK framework, and evolving cloud-based threats, with a focus on attacks targeting Enterprise Apps and emerging AI-driven applications.

Demonstrated experience in securing cloud and containerized environments, coupled with practical knowledge of Azure, AWS, and/or GCP, and technologies such as Kubernetes, container platforms, Storage, Key Vault, DNS, and other cloud services.

In-depth knowledge of adversary tooling, red team frameworks, and attacker techniques, with the proven ability to analyze, simulate, and interpret real-world attacker behaviors across diverse cloud ecosystems.

Proficiency in at least one programming language, such as Python, C, or C++, for creating research prototypes, internal tools, automation scripts, or detection logic.

Strong command of query languages like KQL, SQL, or Cypher for analyzing large-scale telemetry, conducting threat hunting, performing behavioral investigations, and validating detections.

Experience leveraging large-scale datasets to support the development of detections, proactive threat hunting initiatives, behavioral analytics, and the improvement of signal quality.

Exceptional collaboration and communication skills, enabling clear articulation of research findings, effective influence on product and engineering decisions, and seamless collaboration with partner teams, including Engineering, Data Science, and incident response stakeholders.

A Bachelor’s or Master’s degree in Computer Science, Engineering, or a related technical field, or equivalent practical experience in security research or threat detection is required.