Security Research Engineer - Project Perception

Microsoft•,

14d•$119,800 - $304,200•Hybrid

About The Position

Microsoft Security is dedicated to making the world a safer place by protecting customers from digital threats, regulatory scrutiny, and estate complexity. We aim to reshape security and provide a comprehensive security cloud for users, customers, and developers. Our team focuses on transforming real vulnerabilities and adversary behaviors into reproducible tasks for AI models and agents. We emphasize reliable grading and reward signals, ensuring success is based on verified security outcomes. This role involves building realistic, safely contained attack scenarios across cloud, on-premises, and hybrid environments, combining security research with software engineering to reproduce vulnerabilities, construct attack chains, and implement verification checks. The scenarios will support reinforcement learning for Microsoft's MAI models and the evaluation of security Perception agents and their software harnesses. Collaboration with threat researchers, AI engineers, and environment engineers is key to testing systems' ability to distinguish threats, connect evidence, and identify effective responses. The role requires owning scenarios from research to implementation and grading, adapting to evolving attacker techniques to provide trustworthy training signals and evidence of improved security capabilities.

Requirements

Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 6+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
OR equivalent experience.
Ability to meet Microsoft, customer and/or government security screening requirements.
Microsoft Cloud Background Check: This position will be required to pass the Microsoft background and Microsoft Cloud background check upon hire/transfer and every two years thereafter.

Nice To Haves

Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 5+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 8+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 12+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
OR equivalent experience.
5+ years of experience researching vulnerabilities, conducting authorized offensive security tests, investigating security incidents, or developing security tools.
3+ years of experience developing and debugging security tools or scenario automation in Python, C#, Go, C/C++, or TypeScript, using version control and automated tests.
Experience independently reproducing a vulnerability or adversary technique and documenting its prerequisites, reproduction steps, and observed security impact.
Experience building or validating multi-step attack chains across applications, identities, or hosts, including the access requirements and evidence for each step.
Experience assessing cloud IAM in Azure, AWS, or GCP and testing authentication, permissions, or network access in Windows or Linux environments.
Experience confirming or rejecting security findings through source-code review, telemetry, or controlled tests, including checking whether existing safeguards prevent the claimed impact.
Experience running authorized security tests with isolated targets, lab-only credentials, execution limits, and cleanup procedures.
Reconstructed attacks from incident evidence or threat reports for red-team, purple-team, or adversary-emulation exercises.
Reproduced attack paths across cloud and on-premises identity systems involving federation, service principals, workload identities, or directory services.
Used source-code analysis, debugging, or reverse engineering to identify a vulnerability's root cause and verify a fix.
Built automated graders or reward functions that check system state and telemetry, including checks that distinguish scenario failures from agent failures.
Created attack variants, benign comparison cases, patched scenarios, or simulated user activity to test detection accuracy and false positives.

Responsibilities

Turn threat research into working scenarios, reproducing real vulnerabilities and emerging adversary techniques in cloud, on-premises, and hybrid environments.
Build realistic attack chains.
Connect vulnerable applications, identity weaknesses, and misconfigurations into multi-step scenarios with verified prerequisites and observable security impact.
Make outcomes verifiable.
Build automated graders and reward signals grounded in system state and telemetry, distinguishing agent success, effective defenses, and environment failures.
Evaluate beyond familiar patterns.
Create attack variants, benign lookalikes, and patched controls that expose missed threats, false positives, and memorization.
Deliver safe, reusable research.
Own scenario code, isolation, evidence capture and reset; partner with AI and environment engineers to turn findings into better training and evaluation.