Jobs and Careers

Principal Security Research Manager, Applied Threat Intel & Threat Response - Microsoft Security

Washington, United StatesRemotefull_timeVerifiedPosted 14 Aug 2026

💰 $274,800/yr($142,800/yr – $274,800/yr)

About the role

Overview

Security represents the most critical priorities for our customers in a world awash in digital threats, regulatory scrutiny, and estate complexity. Microsoft Security aspires to make the world a safer place for all. We want to reshape security and empower every user, customer, and developer with a security cloud that protects them with end to end, simplified solutions. The Microsoft Security organization accelerates Microsoft’s mission and bold ambitions to ensure that our company and industry is securing digital technology platforms, devices, and clouds in our customers’ heterogeneous environments, as well as ensuring the security of our own internal estate.

Microsoft Security Research is at the front line of defending Microsoft customers and the broader ecosystem against the world’s most sophisticated threat actors. Our Applied Threat Intelligence and Threat Response team serves two complementary missions: producing finished, customer-ready threat intelligence that empowers defenders and shapes the public narrative on the threat landscape — and responding with speed and precision when adversaries act against Microsoft customers and infrastructure in this new AI era.

We are looking for a Principal Security Research Manager to lead this blended team. Your threat intelligence analysts are writers and producers: they author actor profiles, campaign analyses, TTP deep-dives, and vulnerability profiles that ship through Microsoft’s customer-facing surfaces and brief C-suite audiences. Your threat response practitioners are operators: they maintain on-call readiness, lead active incident investigations, and close the loop from response findings back into finished intelligence. You own both missions, the talent that executes them, and the standards that make the work credible and impactful.

Responsibilities

People Leadership

Recruit, develop, and retain a high-performing blended team spanning two distinct but complementary disciplines: finished intelligence production and threat response operations.
Set clear goals for each function, connect individual work to team and business objectives, and adapt priorities as the threat landscape and organizational needs evolve.
Foster a culture of analytic rigor, operational excellence, and continuous learning — modeling Microsoft values and driving team culture improvements daily.
Mentor analysts and responders on tradecraft, career development, and the standards that define great intelligence and response work.

Finished Intelligence Production

Own the team’s customer-ready intelligence output — actor profiles, campaign analyses, TTP deep-dives, vulnerability profiles, and trend reports — with accountability for quality, cadence, and real-world impact.
Establish and maintain analytic standards, tradecraft guidance, and peer review practices that ensure your team’s finished intelligence is credible, prescriptive, and audience-appropriate from SOC analyst to C-suite.
Partner with product, research, marketing, and communications teams to land intelligence through Microsoft’s customer-facing surfaces (Defender XDR, Sentinel, Agentic Security, blogs, executive briefings).

Threat Response Operations

Ensure threat response practitioners are trained, calibrated, and ready for on-call rotation and rapid-response engagements.
Hold the team accountable for quality monitoring, root cause analysis, and post-incident process improvements.
Drive the closed loop between response and intelligence: response findings feed directly into finished intelligence products and detection improvements, making the next response faster and the next report sharper.

Strategy & Cross-Organizational Influence

Develop trusted relationships across the intelligence community, including industry partners, external organizations, and agencies engaged in tracking criminal threat actors.
Define the vision, strategy, and priorities for the team to deliver high-quality intelligence and threat response that drives customer protection and business impact.
Build and operationalize a hybrid human + agentic intelligence team, applying AI technologies, automation, and workflow innovation to improve scale, speed, and insight generation.

Qualifications

Minimum Qualifications:
• Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
○ OR Master'