Principal Security Research Manager, Applied Threat Intel & Threat Response - Microsoft Security

Microsoft•1d ago

United StatesHybridFull-timePrincipal Level3+ yrs exp

H-1B verified · 1338 LCAs

Apply now

Top focus

Security EngineerApplied ScientistResearch ScientistSecurity Architect

Overview Security represents the most critical priorities for our customers in a world awash in digital threats, regulatory scrutiny
estate complexity. Microsoft Security aspires to make the world a safer place for all. We want to reshape security and empower every user, customer
developer with a security cloud that protects them with end to end, simplified solutions. The Microsoft Security organization accelerates Microsoft’s mission and bold ambitions to ensure that our company and industry is securing digital technology platforms, devices
clouds in our customers’ heterogeneous environments, as well as ensuring the security of our own internal estate. Microsoft Security Research is at the front line of defending Microsoft customers and the broader ecosystem against the world’s most sophisticated threat actors. Our Applied Threat Intelligence and Threat Response team serves two complementary missions: producing finished, customer-ready threat intelligence that empowers defenders and shapes the public narrative on the threat landscape — and responding with speed and precision when adversaries act against Microsoft customers and infrastructure in this new AI era. We are looking for a Principal Security Research Manager to lead this blended team. Your threat intelligence analysts are writers and producers: they author actor profiles, campaign analyses, TTP deep-dives
vulnerability profiles that ship through Microsoft’s customer-facing surfaces and brief C-suite audiences. Your threat response practitioners are operators: they maintain on-call readiness, lead active incident investigations
close the loop from response findings back into finished intelligence. You own both missions, the talent that executes them
the standards that make the work credible and impactful. Responsibilities People Leadership Recruit, develop
retain a high-performing blended team spanning two distinct but complementary disciplines: finished intelligence production and threat response operations. Set clear goals for each function, connect individual work to team and business objectives
adapt priorities as the threat landscape and organizational needs evolve. Foster a culture of analytic rigor, operational excellence
continuous learning — modeling Microsoft values and driving team culture improvements daily. Mentor analysts and responders on tradecraft, career development
the standards that define great intelligence and response work. Finished Intelligence Production Own the team’s customer-ready intelligence output — actor profiles, campaign analyses, TTP deep-dives, vulnerability profiles
trend reports — with accountability for quality, cadence
real-world impact. Establish and maintain analytic standards, tradecraft guidance
peer review practices that ensure your team’s finished intelligence is credible, prescriptive
audience-appropriate from SOC analyst to C-suite. Partner with product, research, marketing
communications teams to land intelligence through Microsoft’s customer-facing surfaces (Defender XDR, Sentinel, Agentic Security, blogs, executive briefings). Threat Response Operations Ensure threat response practitioners are trained, calibrated
ready for on-call rotation and rapid-response engagements. Hold the team accountable for quality monitoring, root cause analysis
post-incident process improvements. Drive the closed loop between response and intelligence: response findings feed directly into finished intelligence products and detection improvements, making the next response faster and the next report sharper. Strategy & Cross-Organizational Influence Develop trusted relationships across the intelligence community, including industry partners, external organizations
agencies engaged in tracking criminal threat actors. Define the vision, strategy
priorities for the team to deliver high-quality intelligence and threat response that drives customer protection and business impact. Build and operationalize a hybrid human + agentic intelligence team, applying AI technologies, automation
workflow innovation to improve scale, speed
insight generation. Qualifications Minimum Qualifications:
Doctorate in Statistics, Mathematics, Computer Science, Computer Security
related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection. ○ OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security
related field AND 4+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection. ○ OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security
related field AND 6+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection. ○ OR equivalent experience.
1+ year(s) people management experience. Other Requirements: Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings: Microsoft Cloud Background Check:
This position will be required to pass the Microsoft background and Microsoft Cloud background check upon hire/transfer and every two years thereafter.
This position requires verification of U.S. citizenship due to citizenship‑based legal restrictions. Specifically, this position supports United States federal, state, and/or local government agency customers and is subject to certain citizenship‑based restrictions where required or permitted by applicable law. To meet this legal requirement
as a condition of employment, the successful candidate’s citizenship will be verified via a valid passport. Preferred Qualifications:
Doctorate in Statistics, Mathematics, Computer Science, Computer Security
related field AND 5+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection. ○ OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security
related field AND 8+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection. ○ OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security
related field AND 12+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection. ○ OR equivalent experience.
3+ years people management and/or informal/indirect team leadership experience.
Demonstrated experience producing or overseeing finished threat intelligence reporting for technical and/or executive audiences.
Working experience with Microsoft Sentinel and Microsoft Defender XDR (or directly comparable SIEM/XDR platforms).
10+ years of experience in cyber threat intelligence, threat hunting, incident response, or a closely related security discipline.
Demonstrated track record leading a finished intelligence production function — owning report quality, publication standards, and the analytic tradecraft that makes intelligence credible and actionable.
Experience managing or operating across both intelligence production and incident response disciplines, with fluency in the tension between long-horizon analysis and rapid-response demand.
Portfolio of public or customer-facing intelligence writing (actor profiles, campaign reports, vulnerability analyses, or equivalent).
Understanding of adversary tradecraft and frameworks including MITRE ATT&CK, the Diamond Model, Cyber Kill Chain, and structured analytic techniques.
Experience with endpoint, cloud, network, and identity-based attacks and datasets.
Programming or scripting background (Python, KQL, PowerShell, or equivalent) sufficient to evaluate and guide technical work on the team.
Familiarity with AI-assisted intelligence workflows and automation approaches for threat triage, enrichment
intelligence delivery at scale. #MSSecurity Security Research M5 - The typical base pay range for this role across the U.S. is USD $142,800 - $274,800 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area
the base pay range for this role in those locations is USD $188,000 - $304,200 per year. Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here: https://careers.microsoft.com/us/en/us-corporate-pay This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled. Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation
any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.

Required skills

StatisticsMathematicsComputer ScienceComputer Securitysoftware developmentlarge-scale computingthreat analysiscybersecurityvulnerability researchanomaly detection