Principal Cloud Security Researcher (Remote)

CrowdStrike•USA WY Remote, WY

23h•$195,000 - $310,000•Remote

About The Position

CrowdStrike is seeking the senior-most cloud research role within the Detection Content organization in Threat Detection Platform, situated on the Cloud Detection team. The role sets research direction for cloud content, leads complex projects, and produces original research that advances CrowdStrike’s products and the broader security industry. The researcher will work across cloud control planes, identity, workloads, and Kubernetes on AWS, Azure, and GCP, translating research into detections, posture checks, remediation, and product capabilities. The position focuses on connecting agentic red teaming, detection and response, and automated remediation into a coordinated system. It draws on CrowdStrike’s cloud and identity telemetry, threat hunters, incident responders, and product platform to develop protection for customers. The role also investigates in-the-wild cloud threats and the risks introduced by AI services, model APIs, agent frameworks, and non-human identities. The researcher will apply AI and LLMs to research workflows, influence product and platform direction, publish and present research, engage with cloud providers, and mentor researchers and detection engineers.

Requirements

Extensive experience writing production detection content across multiple platforms or data domains.
Deep understanding of telemetry sources, their limitations, and gaps in coverage.
Ability to reason across threat surfaces such as endpoint, cloud, identity, SaaS, network, and runtime.
Experience designing or contributing to detections that correlate signals across different boundaries.
Current knowledge of threat actors, campaigns, and tactics, techniques, and procedures, with ability to translate intelligence into detection requirements and priorities.
Experience with the detection content lifecycle, including managing aging rules, false-positive drift, performance costs, deprecation decisions, and ongoing measurement of detection quality.
Strong communication and influence skills, including driving alignment across teams and explaining detection strategy to engineers and leadership.
Technical leadership experience guiding or mentoring engineers, reviewing detection content at scale, or setting technical standards for a detection engineering function.
Proven experience using AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency, and drive business outcomes.
Ability to periodically undergo and pass additional background and fingerprint checks consistent with government customer requirements.

Nice To Haves

Experience applying AI or LLMs to detection or security operations workflows.
EDR or SIEM vendor-side product experience.
MITRE ATT&CK fluency across multiple platforms.
Published security research, including blogs, conference talks, tools, or CVEs.
Malware analysis or reverse engineering background.
Experience quantifying detection efficacy, including precision, recall, or bypass resistance.

Responsibilities

Set the technical vision and research direction for cloud threat research across control planes, identity, workloads, and Kubernetes on AWS, Azure, and GCP.
Prioritize research investments and threat scenarios, and translate findings into detections, posture checks, and remediation.
Lead offensive cloud and attack-path research, including novel attack techniques, privilege escalation, credential access, cross-account and cross-tenant abuse, and identity trust weaknesses.
Define attack techniques, tradecraft, scenarios, attack-path generation and validation, and scoring for agentic red teaming.
Translate offensive research and threat intelligence into detection requirements, and advise on detection logic using cloud audit, control-plane, identity, and runtime signals.
Partner with Counter Adversary Operations, Office of Adversary Strategy, Falcon Complete, and incident response to investigate real cloud intrusions, supply chain campaigns, and emerging tradecraft.
Research risks related to AI services, model APIs, agent frameworks, non-human identities, and adversarial use of AI in cloud environments.
Use automation and LLMs to accelerate attack-path discovery, threat intelligence triage, detection prototyping, and validation, and encourage AI-assisted research practices across cloud content teams.
Identify gaps in telemetry, coverage, and platform capabilities, and work with product management, cloud engineering, and platform teams to address them and shape product direction.
Publish original research, speak at industry conferences, contribute to open-source and community efforts, and engage cloud service providers on responsible disclosure and secure defaults.
Mentor researchers and detection engineers, review research and content, and set standards for rigorous cloud security research.