<b>Overview</b><br><p><span style="font-family: arial, helvetica, sans-serif;">Join a team that’s pushing the frontier of modern security research by combining deep attacker‑centric analysis with AI‑augmented, agentic investigation systems. We’re evolving security research beyond purely manual, expert‑driven workflows—amplifying researcher intuition with automation that scales discovery, accelerates investigations, and raises consistency across the board.</span></p><p><span style="font-family: arial, helvetica, sans-serif;">You’ll work on real‑world threats end‑to‑end: dissecting novel attacker techniques, developing detections grounded in adversary behavior, and shaping automated investigation pipelines that turn raw telemetry into actionable insights. A key focus area is Linux and macOS security, where you’ll help close long‑standing visibility gaps and surface emerging attack patterns that traditional approaches miss.</span></p><p><span style="font-family: arial, helvetica, sans-serif;">Your research will directly power AI‑driven campaign discovery and proactive threat hunting, enabling continuous monitoring for new attack classes and faster recognition of evolving adversary tradecraft. You’ll collaborate closely with engineering, applied ML, and product partners to translate research findings into production‑grade protections—ensuring that cutting‑edge research rapidly becomes real customer impact.</span></p><p><span style="font-family: arial, helvetica, sans-serif;">If you’re excited about doing deep technical research with outsized, at‑scale impact, and shaping how the next generation of security investigations are conducted, this team offers a rare opportunity to influence both the art and the system of modern security research.</span></p><br><br><b>Responsibilities</b><br><ul><li><span style="font-family: arial, helvetica, sans-serif;">As a Senior Security Researcher, you will lead deep, attacker‑centric research that directly shapes Microsoft’s endpoint protection strategy. </span></li><li><span style="font-family: arial, helvetica, sans-serif;">You will investigate real‑world adversary behavior, uncover emerging attack techniques, and translate research insights into scalable detections and automated investigation workflows.</span></li><li><span style="font-family: arial, helvetica, sans-serif;">This role sits at the intersection of hands‑on threat research, AI‑augmented investigation, and platform security, with a strong focus on Linux and macOS. </span></li><li><span style="font-family: arial, helvetica, sans-serif;">You will help evolve security research from isolated expert analysis into systematized, automation‑backed discovery that drives consistent, high‑impact customer protection.</span></li><li><span style="font-family: arial, helvetica, sans-serif;">Lead in‑depth investigations of real‑world attacker campaigns, malware, and post‑exploitation techniques across endpoint environments, with emphasis on Linux and macOS platforms.</span></li><li><span style="font-family: arial, helvetica, sans-serif;">Decompose attack chains, map techniques to MITRE ATT&CK, and maintain high‑fidelity adversary and TTP dossiers that inform protection strategy. </span></li><li><span style="font-family: arial, helvetica, sans-serif;">Identify emerging attack classes, tradecraft shifts, and detection gaps before they are widely exploited.</span></li><li><span style="font-family: arial, helvetica, sans-serif;">Design and prototype behavior‑based detections, heuristics, and research‑grade signals that can be operationalized into production protections.</span></li><li><span style="font-family: arial, helvetica, sans-serif;">Partner with engineering and applied ML teams to translate research findings into scalable, reliable detections with clear acceptance criteria and performance trade‑offs.</span></li><li><span style="font-family: arial, helvetica, sans-serif;">Evaluate detection efficacy using offline and online telemetry and continuously refine based on real‑world attacker behavior. </span></li><li><span style="font-family: arial, helvetica, sans-serif;">Contribute to the design of AI‑assisted and agentic investigation pipelines that automate repetitive analysis steps and amplify researcher productivity.</span></li><li><span style="font-family: arial, helvetica, sans-serif;">Shape how attacker techniques, evidence, and hypotheses are represented in systems that enable campaign discovery and proactive hunting at scale.</span></li><li><span style="font-family: arial, helvetica, sans-serif;">Ensure research outputs are structured, explainable, and safe for use in automated or semi‑automated workflows.</span></li><li><span style="font-family: arial, helvetica, sans-serif;">Act as a senior escalation point for complex security incidents, providing expert guidance on attacker behavior, containment strategies, and long‑term mitigation.</span></li><li><span style="font-family: arial, helvetica, sans-serif;">Lead post‑incident analysis and root‑cause investigations, converting learnings into durable detection and tooling improvements.</span></li><li><span style="font-family: arial, helvetica, sans-serif;">Work closely with security engineering, product management, and data science partners to influence roadmap priorities using evidence‑backed research insights. </span></li><li><span style="font-family: arial, helvetica, sans-serif;">Represent security research perspectives in design reviews, detection cutlines, and protection readiness discussions.</span></li><li><span style="font-family: arial, helvetica, sans-serif;">Contribute to internal knowledge‑sharing through technical write‑ups, reviews, and mentoring of junior researchers.</span></li></ul><br><br><b>Qualifications</b><br><ul><li style="font-family: arial, helvetica, sans-serif;"><span style="font-family: arial, helvetica, sans-serif;">7+ years of hands‑on experience in security research, threat analysis, malware analysis, or detection engineering, with demonstrated depth in endpoint security.</span></li><li style="font-family: arial, helvetica, sans-serif;"><span style="font-family: arial, helvetica, sans-serif;">Strong understanding of attacker tradecraft, including persistence, privilege escalation, lateral movement, and defense evasion techniques.</span></li><li style="font-family: arial, helvetica, sans-serif;"><span style="font-family: arial, helvetica, sans-serif;">Proven experience conducting research on Linux and/or macOS internals, endpoint telemetry, or OS‑level attack surfaces.</span></li><li style="font-family: arial, helvetica, sans-serif;"><span style="font-family: arial, helvetica, sans-serif;">Proficiency in at least one scripting or systems language (e.g., Python, C/C++, Go, Rust) used for analysis, tooling, or prototyping.</span></li><li style="font-family: arial, helvetica, sans-serif;"><span style="font-family: arial, helvetica, sans-serif;">Demonstrated ability to independently drive ambiguous, open‑ended investigations from hypothesis to actionable outcome.</span></li><li style="font-family: arial, helvetica, sans-serif;"><span style="font-family: arial, helvetica, sans-serif;">Strong analytical skills for correlating noisy telemetry into attacker‑relevant signals.</span></li><li style="font-family: arial, helvetica, sans-serif;"><span style="font-family: arial, helvetica, sans-serif;">Experience translating deep technical findings into clear, decision‑ready insights for engineering and leadership audiences.</span></li><li style="font-family: arial, helvetica, sans-serif;"><span style="font-family: arial, helvetica, sans-serif;">Proven ability to collaborate effectively across research, engineering, and product teams.</span></li><li style="font-family: arial, helvetica, sans-serif;"><span style="font-family: arial, helvetica, sans-serif;">Experience mentoring or technically leading other researchers without formal people management responsibilities. </span></li><li style="font-family: arial, helvetica, sans-serif;"><span style="font-family: arial, helvetica, sans-serif;">High bar for research quality, operational security, and responsible handling of sensitive techniques and data.</span></li><li style="font-family: arial, helvetica, sans-serif;"><span style="font-family: arial, helvetica, sans-serif;">Experience operationalizing research into production detections or large‑scale protection systems.</span></li><li style="font-family: arial, helvetica, sans-serif;"><span style="font-family: arial, helvetica, sans-serif;">Familiarity with AI‑assisted analysis, automation, or agent‑based systems in security workflows.</span></li><li style="font-family: arial, helvetica, sans-serif;"><span style="font-family: arial, helvetica, sans-serif;">Prior contributions to security blogs, tools, open‑source projects, or industry research publications.</span></li><li style="font-family: arial, helvetica, sans-serif;"><span style="font-family: arial, helvetica, sans-serif;">Experience participating in or supporting external evaluations (e.g., MITRE ATT&CK, red team exercises).</span></li></ul> <br><p>This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.</p><br><hr><br><p>Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about <a href="https://careers.microsoft.com/v2/global/en/accessibility.html"><b><u>requesting accommodations.</u></b></a></p>