Principal Security Researcher

Overview

In this role you will lead threat-hunting investigations for enterprise customers on the GHOST team, translating findings into actions that strengthen Microsoft product and customer defenses. You will collaborate across teams to develop new hunting methods and tooling, and mentor colleagues to raise technical and analytical capabilities.

The position focuses on identifying attacker techniques and helping customers harden their environments, both on-premises and in the cloud. This is a hands-on role at the forefront of defending against advanced threats, with a clear impact on Microsoft customers worldwide.

Responsibilities

• Lead technical workstreams during investigations and guide deep analyses of attacker activity across on-premises and cloud environments
• Identify potential threats and enable proactive defense before incidents occur
• Present technical findings and recommendations to improve customers’ cybersecurity posture and transfer threat intelligence knowledge
• Define requirements for and assist in developing production threat-hunting tools, automations, and new capabilities
• Drive investigation strategies, develop new hunting methodologies, and influence security products and practices across teams
• Mentor others to strengthen technical and interpersonal skills

Key requirements

• Extensive experience in Threat Hunting, Incident Response (DFIR), Threat Intelligence, or Security Research
• Experience investigating sophisticated cyber threats including APT or nation-state activity
• Experience with forensically collected data, security telemetry, logs, and SIEM platforms
• Expertise in KQL or equivalent query languages (Splunk, Humio, Kibana)
• Experience with EDR and security monitoring technologies (Microsoft Defender, Microsoft Sentinel, CrowdStrike)
• Experience managing or conducting security reviews of Microsoft Azure tenants, Microsoft 365, and Entra ID
• Ability to analyze security data to identify IOAs/IOCs and TTPs
• Experience with digital forensics data collection and tools (e.g., X-Ways Forensics)
• Strong written and verbal English communication; ability to work in a global team
• Ability to obtain and maintain UK security clearance
• Mentoring and coaching
• Cross-team collaboration
• Strong communication and presentation skills
• KQL or equivalent (Splunk, Humio, Kibana)
• EDR and security monitoring (Defender, Sentinel, CrowdStrike)
• Threat hunting methodologies

Report this job