Senior Security Researcher Job at Microsoft Corporation (Redmond)

Senior Security Researcher

Microsoft Corporation

Location:
United States , Redmond

Category:
IT - Software Development

Contract Type:
Not provided

Salary:

119800.00 - 234700.00 USD / Year

Save Job

Apply Position

Job Description:

The Intelligence Graph Research team within Microsoft CTO organization is responsible for defending Microsoft Cloud and our customers through innovation in security graph research and abuse identification. Defending Microsoft Coud’s complex environment provides a unique opportunity to research, build and evaluate autonomous graph powered defense through emerging generative AI capabilities. We’re looking for a Senior Security Researcher to help us detect and disrupt real-world threats at cloud scale. You’ll build novel anomaly detections over vast Azure, Entra, and bespoke telemetry; convert detections into production-grade machine learning (ML) models; and develop security agents that reduce response fatigue during long-running investigations. You’ll work deeply with a security graph that connects identity, resources, activity, and risk to accelerate investigations and drive high-signal outcomes. This role blends threat research, data science, and applied engineering: you’ll prototype quickly, validate with evidence, and deliver scalable systems that materially improve detection, triage, and investigation speed.

Job Responsibility:

Build cloud-scale anomaly detections: Design and implement high-signal anomaly detectors across Azure/Entra and custom log sources (control plane, data plane, identity/auth, app activity, Graph API, Key Vault, storage, etc.)
Create detection funnels that reduce noise while preserving true positives, with measurable improvements in alert quality and investigation time
Develop baselines and “pattern-of-life” models for identities, service principals, applications, tenants, and infrastructure
Convert detections into ML models and scalable pipelines: Translate research detections into ML approaches (supervised, weakly-supervised, semi-supervised, anomaly detection) and deploy them into reliable pipelines
Engineer features at scale (time-series aggregates, behavior fingerprints, graph-derived features, sequence features) and evaluate performance with rigorous metrics (precision/recall, alert volume, time-to-triage, drift)
Own end-to-end lifecycle from hypothesis to productionization

Requirements:

Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection OR equivalent experience
Ability to meet Microsoft, customer and/or government security screening requirements are required for this role
8+ years of experience in security research, detection engineering, threat hunting, incident response, or applied security data science (or equivalent depth of expertise)
3+ years of experience in Azure and Entra security concepts: authentication flows, service principals/app registrations, permissions/consents, conditional access, role assignments, tokens, workload identities, and common abuse paths
3+ years building anomaly detections over large-scale telemetry, including Baselines, time-series aggregates, and behavioral modeling, High-volume log analytics and query optimization (e.g., KQL/ADX or equivalent), Designing alert funnels and triage logic to reduce noise
3+ years in experience in applied ML skills for security problems: Feature engineering, model selection, evaluation design, drift monitoring, Experience shipping ML or statistical detection into production systems
3+ years in experience in Python/C# (data pipelines, modeling, production code quality), distributed processing (e.g., Spark/Databricks/Flink) and large datasets (Parquet/data lakes)
1+ years experience with graph analytics for security use cases (attack paths, entity resolution, graph embeddings, community detection, anomaly scoring) and/or graph databases (Neo4j or similar)
1+ years experience building or operationalizing LLM-powered or agentic investigation systems: Tool-driven agents, retrieval, memory, prompt/eval harnesses, guardrails, and human-in-the-loop workflow
1+ years with Microsoft cloud security telemetry sources such as: Entra sign-in/audit logs, app consent events, Azure activity logs, Key Vault diagnostics, storage access logs, Graph API activity, etc
1+ years experience designing scalable detection systems: streaming pipelines, batch + near-real-time architectures, and reliability/observability

Additional Information:

Job Posted:
February 17, 2026

Employment Type:

Fulltime

Work Type:

Hybrid work

Microsoft Corporation - All Job Offers

Job Link Share: