Senior Security Researcher - CTJ - TS/SCI

Microsoft•Reston, VA

About The Position

Microsoft Defender builds security products deployed across Windows, Windows Server, macOS, and common Linux enterprise distributions. The Senior Security Researcher contributes to the quality and effectiveness of Microsoft Defender for Endpoint (MDE) by responding to customer escalations, investigating false positives and false negatives, creating and tuning threat detections, and serving as a tier-2 escalation point. The role conducts deep endpoint threat research and owns detection work from initial threat analysis through implementation, testing, deployment, monitoring, and tuning. Researchers use AI and agentic workflows to automate investigative and detection tasks while retaining responsibility for final decisions, and collaborate across teams to address protection gaps.

Requirements

Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or a related field; or a master's degree in one of these fields and 3+ years of relevant experience; or a bachelor's degree in one of these fields and 4+ years of relevant experience; or equivalent experience.
Relevant experience may include software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
Must have an active TS/SCI clearance and be willing and eligible to upgrade to TS/SCI with polygraph; must maintain the TS/SCI with polygraph clearance.
Must meet Microsoft, customer, and/or government security screening requirements, including clearance verification and the Microsoft Cloud background check upon hire or transfer and every two years thereafter.
Must provide verification of U.S. citizenship due to citizenship-based legal restrictions.

Nice To Haves

Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or a related field and 3+ years of relevant experience; or a master's degree in one of these fields and 6+ years of relevant experience; or a bachelor's degree in one of these fields and 8+ years of relevant experience; or equivalent experience.
Relevant experience may include software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.

Responsibilities

Conduct deep endpoint threat research, including malware reverse engineering, attacker techniques, exploitation, defense evasion, persistence, and emerging threats.
Investigate false positives, false negatives, missed detections, and customer escalations, applying findings to improve MDE protection quality.
Analyze MDE telemetry, malware samples, threat intelligence, customer incidents, and hunting data to identify attack patterns and protection gaps.
Own detection work end to end, from threat hypothesis and technical analysis through implementation, testing, deployment, monitoring, and tuning.
Use AI and agentic workflows to automate investigation, enrichment, malware analysis, detection development, testing, and validation, while retaining researcher judgment for final decisions.
Drive cross-team work to resolve protection gaps involving research, telemetry, engineering, or product boundaries.
Respond to customer escalations and act as a tier-2 escalation point.