Security Researcher – Cybersecurity Infrastructure Engineer

Overview

In this role you will lead infrastructure recovery and identity containment initiatives within a globally distributed Cybersecurity Incident Response team. You will work with investigators and threat hunters to guide evidence-led recovery decisions, balancing urgency with customer constraints. You’ll mentor peers, share practical recovery expertise and help shape Defender Experts Cybersecurity Incident Response. This position blends hands-on technical work with customer-facing leadership to improve security outcomes.

Responsibilities

• Lead or support evidence-driven infrastructure recovery and identity hardening workstreams across on‑premises and cloud environments.
• Set recovery objectives and priorities for identity, directory, privileged access and enterprise infrastructure.
• Lead or support containment and recovery for compromised Active Directory, Entra ID, Tier 0 and hybrid environments.
• Assess compromise scope, recovery readiness, trust relationships and security-control gaps; identify what is known and what remains uncertain.
• Direct or guide technical response activities balancing containment, urgency, evidence preservation and customer constraints.
• Collect, preserve and analyze infrastructure and identity evidence to support investigation and recovery decisions.
• Serve as technical point of contact for infrastructure recovery; brief customer technical teams, executives and internal stakeholders.
• Maintain documentation and handovers covering evidence, decisions, risks and next actions; support final reporting and lessons learned.

Key requirements

• A relevant degree in Computer Science, Computer Security, Statistics, Mathematics or related field, or equivalent practical experience.
• Hands-on experience with Active Directory, Entra ID or other enterprise identity platforms in complex environments.
• Understanding of identity-related attack techniques.
• Experience supporting identity recovery, infrastructure recovery and post-breach hardening under operational pressure.
• Familiarity with Windows Server infrastructure, DNS, DHCP, Group Policy, privileged access and hybrid identity dependencies.
• Ability to script or automate recovery, validation or analysis tasks using PowerShell or similar tools.
• Ability to explain technical findings clearly to customers and stakeholders.
• Flexibility to work non-standard hours (evenings, nights, weekends, holidays).

• clear communication
• customer-facing collaboration
• ability to explain complex concepts to non-technical stakeholders
• Active Directory
• Entra ID
• Windows Server

…