Principal Security Research Manager, Applied Threat Intel & Threat Response - Microsoft Security

Microsoft • Redmond, WA

3d

About The Position

Microsoft Security is seeking a Principal Security Research Manager to lead a blended team focused on Applied Threat Intelligence and Threat Response. This team produces customer-ready threat intelligence to empower defenders and shape the public narrative on the threat landscape, while also responding with speed and precision to threats against Microsoft customers and infrastructure. The role involves owning both intelligence production and threat response missions, managing the talent executing them, and upholding high standards for credible and impactful work in the AI era.

Requirements

• Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
• OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
• OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 6+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
• OR equivalent experience.
• 1+ year(s) people management experience.
• Ability to meet Microsoft, customer and/or government security screening requirements.
• Microsoft Cloud Background Check required upon hire/transfer and every two years thereafter.
• Verification of U.S. citizenship required due to citizenship-based legal restrictions for supporting U.S. federal, state, and/or local government agency customers.

Nice To Haves

• Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 5+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
• OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 8+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
• OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 12+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
• OR equivalent experience.
• 3+ years people management and/or informal/indirect team leadership experience.
• Demonstrated experience producing or overseeing finished threat intelligence reporting for technical and/or executive audiences.
• Working experience with Microsoft Sentinel and Microsoft Defender XDR (or directly comparable SIEM/XDR platforms).
• 10+ years of experience in cyber threat intelligence, threat hunting, incident response, or a closely related security discipline.
• Demonstrated track record leading a finished intelligence production function — owning report quality, publication standards, and the analytic tradecraft that makes intelligence credible and actionable.
• Experience managing or operating across both intelligence production and incident response disciplines, with fluency in the tension between long-horizon analysis and rapid-response demand.
• Portfolio of public or customer-facing intelligence writing (actor profiles, campaign reports, vulnerability analyses, or equivalent).
• Understanding of adversary tradecraft and frameworks including MITRE ATT&CK, the Diamond Model, Cyber Kill Chain, and structured analytic techniques.
• Experience with endpoint, cloud, network, and identity-based attacks and datasets.
• Programming or scripting background (Python, KQL, PowerShell, or equivalent) sufficient to evaluate and guide technical work on the team.
• Familiarity with AI-assisted intelligence workflows and automation approaches for threat triage, enrichment, and intelligence delivery at scale.

Responsibilities

• Recruit, develop, and retain a high-performing blended team spanning finished intelligence production and threat response operations.
• Set clear goals for each function, connect individual work to team and business objectives, and adapt priorities as the threat landscape and organizational needs evolve.
• Foster a culture of analytic rigor, operational excellence, and continuous learning, modeling Microsoft values and driving team culture improvements.
• Mentor analysts and responders on tradecraft, career development, and the standards that define great intelligence and response work.
• Own the team’s customer-ready intelligence output (actor profiles, campaign analyses, TTP deep-dives, vulnerability profiles, and trend reports), ensuring quality, cadence, and real-world impact.
• Establish and maintain analytic standards, tradecraft guidance, and peer review practices for credible, prescriptive, and audience-appropriate intelligence.
• Partner with product, research, marketing, and communications teams to disseminate intelligence through Microsoft’s customer-facing surfaces.
• Ensure threat response practitioners are trained, calibrated, and ready for on-call rotation and rapid-response engagements.
• Hold the team accountable for quality monitoring, root cause analysis, and post-incident process improvements.
• Drive the closed loop between response and intelligence, ensuring response findings feed into intelligence products and detection improvements.
• Develop trusted relationships across the intelligence community, including industry partners, external organizations, and agencies.
• Define the vision, strategy, and priorities for the team to deliver high-quality intelligence and threat response.
• Build and operationalize a hybrid human + agentic intelligence team, applying AI technologies, automation, and workflow innovation.

Benefits

• Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances.
• If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior