Job description

As a Security Researcher II within the Cloud App and Identity Research (CAIR) team, you will work on edge technology of AI and Cloud, conducting security research of Microsoft Defender for Cloud Apps and engaging with the security ecosystem. The role requires expertise in cloud security, attacker kill chains, and a strong foundation in programming and query languages.

Responsibility

• Perform attacker tradecraft research and threat landscape investigation across cloud-based attacks spanning Oauth Application, Enterprise Applications, AI Applications and their authentication mechanism
• Partner with engineers and product managers to deliver innovative product capabilities
• Threat hunting to discover real world advanced attacks together with designing and implementing automated detection and hunting analytics combining alerts and signals across Microsoft Defender security products.
• Contribute to active engagement with the camera security ecosystem through papers, presentations, and blogs.
• Provide subject matter expertise to customers based on industry attack trends and product capabilities.

Qualifications

• 8+ years work experience in cloud funding and hands-on experience in investigation/ hunting real world threats.
• 5+ years of experience in cyber security with a background in the modern attacker kill-chain, MITRE ATT&CK, and emerging enterprise threats including attacks against SaaS Apps and AI Apps, and Oauth Apps.
• BS or equivalent experience in computer science, engineering, or information technology.
• Proficient in at least one programming language such as Python, C#, or C++.
• Proficient in at least one query language such as KQL, SQL, Cypher
• Excellent cross-group and interpersonal skills, with the ability to articulate the business need for product improvements and a desire to engage directly with customers.
• Ability to meet Microsoft, customer and/or government security screening requirements are required for this role.
• Offensive security research experience for cloud-based attacks.
• Industry recognized author of security research papers, blogs, presentations, or books.
• SOC or blue team experience involving the hunting and discovery of adversaries in enterprise environments