Principal Security Research - Microsoft Defender ( Identity Threat Detection and Response)

Microsoft • Herzliya,

32d

About The Position

Microsoft Security is hiring a Principal Security Researcher to help build Identity Threat Detection and Response (ITDR), a security product that helps enterprises detect, investigate, and autonomously protect against identity-based attacks and data breaches. The researcher will set technical direction for a major area of identity protection research, lead multi-quarter research agendas, and mentor and influence the team. They will collaborate with engineering, product management, data science, and other research teams to shape strategy and capabilities, and represent Microsoft Security externally through publications, talks, and industry engagement. The role also involves shaping how Generative AI is applied to research, detection authoring, investigation, and customer protection at Microsoft scale.

The position requires deep security research experience, particularly in identity threats, attacker tradecraft, and the modern kill chain. The researcher will lead complex investigations, develop resilient detection logic, deliver initiatives through production, and drive measurable customer impact. Microsoft requires the successful candidate to pass its background and Microsoft Cloud background checks upon hire or transfer and every two years thereafter. The position will be open for at least five days, with applications accepted on an ongoing basis until filled.

Requirements

• At least 10 years of experience in security research.
• At least 8 years of experience in cybersecurity research, with a strong background in the modern attacker kill chain and MITRE ATT&CK.
• Deep expertise in identity-based threats and identity protection, ideally in enterprise security or Identity Threat Detection and Response.
• Proficiency developing in at least one of C++, C#, Java, or Python.
• Experience leading a feature from design through production delivery, including design, coding, testing, and deployment.
• Strong cross-group collaboration and interpersonal skills.
• Ability to meet Microsoft, customer, and/or government security screening requirements, including the Microsoft background and Microsoft Cloud background checks upon hire or transfer and every two years thereafter.

Nice To Haves

• B.Sc. or M.Sc. in Computer Science or Software Engineering, or equivalent practical experience, such as service in an elite technology unit in the IDF.
• Track record of leading multi-quarter research initiatives end-to-end, from problem framing and execution to shipped outcomes and measurable customer impact across organizational boundaries.
• Technical leadership and influence beyond the immediate team, including cross-organization partnerships, setting technical standards, mentoring senior peers, building consensus on ambiguous technical decisions, and influencing without authority.
• Deep expertise in OS internals and forensics, including artifacts related to lateral movement and credential theft, and strong knowledge of identity protocols such as Kerberos, NTLM, LDAP, OAuth 2.0, OpenID Connect, and SAML, as well as cloud identity architectures such as Entra ID.
• Experience with cloud forensics and hybrid environments, including identity attack artifacts and lateral movement techniques across on-premises and cloud environments.
• Fluency with Generative AI tools and AI-assisted workflows, including prompt design, model-output validation, and reusable AI-assisted approaches for security research, detection engineering, or threat intelligence at scale.
• Established external security research leadership demonstrated through research papers, conference talks, high-impact blogs, CVEs, or open-source contributions.
• Prior experience at Principal (IC5) or equivalent level and motivation to tackle difficult, ambiguous identity-threat problems.

Responsibilities

• Set technical direction and own the multi-quarter strategy for a major area of identity protection research, from threat landscape framing through shipped detection and measurable customer impact.
• Drive multiple concurrent, end-to-end research initiatives and break ambiguous problems into tractable workstreams.
• Lead investigations and research across identity and adjacent data sources to identify novel threats, attacker tradecraft, and detection opportunities.
• Track the evolving attacker landscape and design sophisticated detection logic across the kill chain that is high-quality, comprehensive, and resilient to evasion.
• Partner across product management, engineering, data science, and research teams to shape product strategy, define identity protection capabilities, and align roadmaps using data.
• Mentor and develop IC3–IC4 researchers through code and design reviews, research coaching, and apprenticeship on complex investigations.
• Define and evaluate Generative AI practices and develop reusable AI-assisted workflows for data triage, hypothesis generation, code and KQL authoring, and detection synthesis.
• Represent Microsoft Security through research publications, conference talks, blog posts, and engagement with the security research community.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal
• Education Level: No Education Listed