About the Role:Cloud is where the modern breach lives. Adversaries don't need malware to win there: a leaked long-lived key, an over-trusted role, a misconfigured federation, or a poisoned CI/CD pipeline is enough. And they're no longer working by hand. Threat actors are AI-force-multiplied. They stand up campaigns in hours, enumerate cloud environments at machine speed, and generate permutations on the fly. We need to find, detect, and fix cloud attack paths at the same scale and velocity.
We're building toward that with agentic systems across the full lifecycle: red (agentic red teaming that continuously discovers attack paths in cloud environments), blue (agentic detection and response for cloud), and green (automated remediation, preventive policy, and posture guardrails). We need a research leader who understands all three deeply and can make them work as one system.
This is the senior-most research role for cloud within the Detection Content organization in Threat Detection Platform. It sits within the Cloud Detection team and has high visibility, high impact, and broad mandate: set the research direction for all cloud content, lead the hardest projects personally, and produce original research that moves the product and the industry forward. You will lead through expertise, technical direction, and influence.
You'll have visibility across one of the largest cloud and identity telemetry footprints in the industry, front-line insight from our threat hunters and incident responders, and a platform that can turn a single research finding into protection for thousands of customers overnight.
What You'll Do:- Set research direction across all cloud content. Own the technical vision for cloud threat research spanning control plane, identity, workloads, and Kubernetes across AWS, Azure, and GCP. Decide where research investment goes, which threat scenarios matter most, and how findings translate into detections, posture checks, and remediation. Have a hand in every major cloud content initiative.
- Lead offensive cloud and attack-path research. Discover novel attack techniques, privilege escalation paths, credential access methods, cross-account and cross-tenant abuse, and identity trust weaknesses before adversaries operationalize them. Model how real attackers chain misconfigurations, permissions, and exposures into breaches, and turn that model into coverage.
- Shape agentic red teaming for Cloud. Provide the adversarial expertise behind our agentic red team capability. Define the attack techniques, tradecraft, and scenarios agents should execute, how attack paths should be generated and validated at scale, and how results should be scored. Make sure our agents think like the most sophisticated cloud attackers.
- Guide agentic detection and response. Translate offensive research and threat intelligence into detection requirements. Advise on detection logic over cloud audit and control-plane telemetry, identity signals, and runtime events. Ensure detections are behavioral, high-fidelity, and resilient to the variation that AI-generated attacks introduce.
- Investigate in-the-wild cloud threats. Partner with Counter Adversary Operations, Office of Adversary Strategy, Falcon Complete, and incident response to analyze real cloud intrusions, supply chain campaigns, and emerging tradecraft. Turn what adversaries are doing today into what our platform detects and prevents tomorrow.
- Research the AI attack surface in the cloud. Investigate how AI services, model APIs, agent frameworks, and non-human identities change cloud risk, and how adversaries are using AI to accelerate attacks. Keep CrowdStrike ahead of the curve as AI adoption outpaces the security foundations beneath it.
- Apply AI/LLM to research workflows. Use automation and large language models to accelerate attack-path discovery, threat intel triage, detection prototyping, and validation. Drive adoption of AI-assisted research practices across the cloud content teams.
- Influence product and platform direction. Identify gaps in cloud telemetry, coverage, and platform capabilities that limit what we can detect and fix. Work with product management, cloud engineering, and platform teams to close them, and help define where the cloud product should go to build a durable competitive edge.
- Be CrowdStrike's voice in cloud security research. Publish original research, speak at industry conferences, contribute to open-source and community efforts, and engage with cloud service providers to responsibly disclose issues and drive secure defaults. Raise the bar for the industry, not just our product.
- Mentor and raise the bar. Coach researchers and detection engineers across cloud teams. Review research, detection logic, and remediation content. Set the standard for what rigorous cloud security research looks like.
What You'll Need:- Strong detection engineering background. Have extensive experience writing production detection content across multiple platforms or data domains. Deep understanding of different telemetry sources, their limitations, and where coverage breaks down.
- Cross-domain thinking. Demonstrated ability to reason about threats that span multiple surfaces, endpoint to cloud, identity to SaaS, network to runtime. Have designed or contributed to detections that correlate signals across boundaries.
- Threat landscape fluency. Stay current on threat actors, campaigns, and TTPs. Able to translate threat intelligence into detection requirements and prioritization decisions.
- Detection content lifecycle experience. Understand what happens when detection libraries scale, aging rules, FP drift, performance cost, deprecation decisions. Have operated in an environment where detection quality is measured and maintained over time.
- Strong communication and influence. Able to work across multiple teams, drive alignment, and articulate detection strategy to both engineers and leadership. Able to drive outcomes through expertise and relationships.
- Technical leadership. Have guided or mentored engineers on detection quality, reviewed detection content at scale, or set technical standards for a detection engineering function.
- Proven experience utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes.
Bonus Points:- Experience applying AI/LLM to detection or security operations workflows
- EDR or SIEM vendor-side product experience
- MITRE ATT&CK fluency across multiple platforms
- Published security research (blogs, conference talks, tools, CVEs)
- Malware analysis or reverse engineering background
- Experience quantifying detection efficacy (precision, recall, bypass resistance)
#LI-AV1
#LI-Remote
This role will require the candidate to periodically undergo and pass additional background and fingerprint check(s) consistent with government customer requirements.
Benefits of Working at CrowdStrike:- Market leader in compensation and equity awards
- Comprehensive physical and mental wellness programs
- Competitive vacation and holidays for recharge
- Paid parental and adoption leaves
- Professional development opportunities for all employees regardless of level or role
- Employee Networks, geographic neighborhood groups, and volunteer opportunities to build connections
- Vibrant office culture with world class amenities
- Great Place to Work Certified™ across the globe
CrowdStrike is committed to fair and equitable compensation practices. Placement within the pay range is dependent on a variety of factors including, but not limited to, relevant work experience, skills, certifications, job level, supervisory status, and location. The base salary range for this position for all U.S. candidates is $195,000 - $310,000 per year, with eligibility for bonuses, equity grants and a comprehensive benefits package that includes health insurance, 401k and paid time off.
For detailed information about the U.S. benefits package, please click here.
