OverviewThe Microsoft Threat Protection Research (MTP-R) Purple Team sits at the intersection of offense, defense, and intelligence, working across Microsoft Defender technologies to ensure telemetry, detections, and protections are effective against real-world cyberattacks. We are looking for a senior-level red team security researcher with experience in adversary emulation, offensive tooling, and malware development to design and execute realistic attack simulations in an AI-first environment. This role will use agentic systems and LLM-driven workflows to scale attack development, automation, and simulation fidelity, while helping shape how AI-enabled offensive research is used to emulate modern adversaries in controlled, high-impact ways.
ResponsibilitiesAs a Senior Security Researcher on the MTP Research Purple Team, you will:
• Design and execute adversary simulations that emulate real-world threat actors across endpoint, identity, cloud, and SaaS environments.
• Develop and modify offensive tooling, including custom payloads, loaders, and command-and-control (C2) frameworks.
• Conduct malware development and tradecraft research to replicate modern attacker techniques such as evasion, persistence, and lateral movement.
• Leverage threat intelligence to inform adversary emulation scenarios, including campaign design, TTP selection, and operational sequencing.
• Apply threat modeling frameworks such as MITRE ATT&CK to emulate realistic attack paths and identify defensive gaps.
• Utilize AI-enabled and agentic systems to generate attack variations, automate tradecraft execution, and scale simulation coverage.
• Partner with blue team and detection engineering teams to validate detections and improve defensive capabilities.
• Analyze telemetry generated from simulations to assess detection coverage and identify opportunities for improvement.
• Contribute to simulation reports, technical documentation, and internal knowledge sharing.
• Collaborate across teams to improve offensive tooling, methodologies, and research practices.
QualificationsMinimum Qualifications:- Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field.
- OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
- OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
- OR equivalent experience.
Other Requirements:Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings:
Microsoft Cloud Background Check:
- This position will be required to pass the Microsoft background and Microsoft Cloud background check upon hire/transfer and every two years thereafter.
Preferred Qualifications:- Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
- OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 6+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
- OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 8+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
- OR equivalent experience.
- 5+ years of incident response, threat hunting, and/or SOC experience.
- Experience leveraging and producing threat intelligence at the campaign or actor level.
- Knowledge of MITRE ATT&CK and threat modeling methodologies.
- Security related certifications such as: GCIA, GMON, GCIH, CISA.
- 3+ years of experience with coding.
- Experience in classical and deep learning machine learning methods.
Security Research IC4 - The typical base pay range for this role across the U.S. is USD $119,800.00 - $234,700.00 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $160,200.00 - $261,000.00 per year.
Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
https://careers.microsoft.com/us/en/us-corporate-pay
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.
