Security Research Engineer, Project Perception

What you'll do

• Reproduce real vulnerabilities and emerging adversary techniques in cloud, on-premises, and hybrid environments.
• Build realistic multi-step attack chains by connecting vulnerable applications, identity weaknesses, and misconfigurations.
• Develop automated graders and reward signals grounded in system state and telemetry to verify security outcomes.
• Create attack variants, benign lookalikes, and patched controls to expose missed threats and false positives.
• Own scenario code, isolation, evidence capture, and reset procedures for safe research.
• Partner with AI and environment engineers to turn research findings into training and evaluation signals.
• Test whether systems can distinguish threats from benign activity and connect evidence across attack chains.

What we're looking for

• Must have a Doctorate with 3+ years, Master's with 4+ years, or Bachelor's with 6+ years of experience in relevant fields or equivalent experience.
• Must be able to pass the Microsoft background and Microsoft Cloud background check.
• Must reside within commuting distance of the Redmond or Reston hub to work on-site under a hybrid arrangement.
• 5+ years of experience researching vulnerabilities, conducting authorized offensive security tests, investigating security incidents, or developing security tools (preferred).
• 3+ years of experience developing and debugging security tools or scenario automation in Python, C#, Go, C/C++, or TypeScript (preferred).
• Experience independently reproducing vulnerabilities and documenting prerequisites, reproduction steps, and observed security impact (preferred).
• Experience building or validating multi-step attack chains across applications, identities, or hosts (preferred).
• Experience assessing cloud IAM in Azure, AWS, or GCP and testing authentication or network access in Windows or Linux (preferred).