Senior Security Researcher

Microsoft•Redmond, WA

About The Position

Microsoft Security aims to protect users, customers, and developers from digital threats with simplified, end-to-end security solutions. Microsoft Defender for Endpoint provides preventative protection, post-breach detection, automated investigation, and response. The core machine learning and data science team builds machine learning, large language model, and automation solutions for Microsoft Defender Antivirus, Endpoint Detection and Response, and Network Protection products, protecting more than a billion end users and enterprises. The Senior Security Researcher investigates cybersecurity attacks and develops durable detection and prevention solutions. The role combines telemetry-based attack investigations and threat hunting with light reverse engineering, and includes building machine learning and automation systems for client and cloud environments. The researcher will also experiment with language models and agentic systems, support incident diagnosis and triage, and work with internal and external teams to improve product partnerships.

Requirements

Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or a related field; or a master's degree in one of these fields and at least 3 years of relevant experience; or a bachelor's degree in one of these fields and at least 4 years of relevant experience; or equivalent experience.
Relevant experience includes software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
Ability to meet Microsoft, customer, and/or government security screening requirements, including the Microsoft Cloud Background Check upon hire or transfer and every two years thereafter.

Nice To Haves

Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or a related field and at least 3 years of relevant experience; or a master's degree in one of these fields and at least 6 years of relevant experience; or a bachelor's degree in one of these fields and at least 8 years of relevant experience; or equivalent experience.
At least 2 years of coding experience.
At least 1 year of experience with language models or machine learning.
Experience with classical and deep learning machine learning methods.
Experience with reverse engineering.

Responsibilities

Investigate, analyze, and learn from ongoing cybersecurity attacks to develop durable detection and prevention solutions or strategies across the kill chain, including product or operating system enhancements.
Lead and share work within the team.
Conduct telemetry-based attack investigations and threat hunting, with some reverse engineering.
Design, code, and maintain client-side and cloud machine learning and automation systems that power cybersecurity protection in products and services.
Experiment with and apply large language models and agentic systems to protect customers and improve internal systems.
Support incident management by applying technical knowledge to diagnose and triage issues while maintaining product and service quality.
Take notes during incidents and participate in postmortems and root-cause analysis.
Work with internal and external teams to develop new partnerships and improve existing ones.