Principal Security Research Lead

Security represents the most critical priorities for our customers in a world awash in digital threats, regulatory scrutiny, and estate complexity. Microsoft Security aspires to make the world a safer place for all. We want to reshape security and empower every user, customer, and developer with a security cloud that protects them with end to end, simplified solutions. The Microsoft Security organization accelerates Microsoft’s mission and bold ambitions to ensure that our company and industry is securing digital technology platforms, devices, and clouds in our customers’ heterogeneous environments, as well as ensuring the security of our own internal estate. Our culture is centered on embracing a growth mindset, a theme of inspiring excellence, and encouraging teams and leaders to bring their best each day. In doing so, we create life-changing innovations that impact billions of lives around the world.

The Microsoft Extended Detection and Response (XDR) and Security Information and Event Management (SIEM) research team empowers security teams around the world to efficiently and effectively detect and respond to cyber-attacks. We achieve this by combining a deep understanding of threats- their objectives, tactics, and techniques; expert knowledge of the technologies that threats exploit; and fostering our researchers' curiosity and 'think like an attacker' mindset to constantly learn and adapt to a dynamic landscape. Security operation centers face a huge scale challenge where the difficulties of defending their environments increase over time while the resources available to them are always under threat. Our team leads the way in bringing Microsoft's security expertise to customers through AI technologies that quickly and automatically investigate and respond to both common and sophisticated threats. Our goal is to swiftly comprehend new and emerging threats, develop automated actions and investigation methods to protect customers all with a goal of helping security operations teams be as efficient as possible.

We are looking to hire a Principal Security Research Lead who will empower the SOC by delivering a full view of all attacks in an organization by creating a single incident queue, reduces alert noise, and improves alert correlation across Microsoft Sentinel and Microsoft Defender data sources. You will leverage Microsoft’s security expertise and automation platforms to enhance and scale the defensive abilities of our customers and their security operations centers to counter the persistent threats they face.

Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

Qualifications

Qualifications - Required:

1. Relevant years of computer security industry experience with knowledge of adversary tradecraft, security operations, incident response, threat hunting, and of emerging threats and techniques for attacks against modern enterprise environments.
2. OR Doctorate in Statistics, Mathematics, Computer Science or related field.
3. Relevant experience designing, prototyping, and driving engineering requirements for threat protection systems.
4. Relevant experience hunting for and investigating security incidents at scale with one or more of the following: Azure Synapse, Azure Data Lake, SQL, Cosmos, Kusto, or similar systems.

Preferred Requirements:

1. Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings: Microsoft Cloud Background Check: This position will be required to pass the Microsoft background and Microsoft Cloud background check upon hire/transfer and every two years thereafter.
2. Experience within coding with languages such as C#, Python and/or PowerShell AND language independent data formats such as JSON/ YAML/XML.
3. Experience applying MITRE ATT&CK to assess threat scenarios and protection coverage across both cloud and hybrid (cloud + on prem) attacks.
4. Experience with endpoint, identity, cloud application, cloud infrastructure, email, network and/or other threat detection, and prevention technologies.
5. Experience with security orchestration, automation, and response (SOAR) technologies that span investigation and response automation across diverse security tool integrations.
6. Experience with cross-group and interpersonal skills, with the ability to articulate the business need for product improvements and a desire to engage directly with customers.
7. Research and delivery of security product features to general availability.
8. Demonstrated experience in conducting data studies, including the ability to work with available telemetry and drive improvements with engineering teams for previously unexplored data sources.
9. Experience with one or more of the following: Azure Functions, Azure Static Web Sites, Azure Containers, Azure DevOps pipelines, Github actions, Github Codespaces, and Jupyter Notebooks.

Responsibilities

1. Guide a team of security researchers to collaboratively build practical solutions towards quantifiable impact against in-progress attacks.
2. Work with data from many different security domains across email, identity, endpoint, and cloud to build the most accurate and precise automated protection capabilities.
3. Collaborate closely with partner engineering and product management teams to push the boundaries of innovation.
4. Demonstrate leadership principles of model, coach, and care for team members.
5. Foster diverse perspectives and inclusive behaviors.
6. Embody our culture and values.

Benefits/perks listed below may vary depending on the nature of your employment with Microsoft and the country where you work.

Industry leading healthcare

Educational resources

Discounts on products and services

Savings and investments

Maternity and paternity leave

Generous time away

Giving programs

Opportunities to network and connect

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.