Principal Cloud Security Researcher

CrowdStrike

. Set research direction across all cloud content and own the technical vision for cloud threat research across control plane, identity, workloads, and Kubernetes on AWS, Azure, and GCP .

Posted 11/12/2026full-timeRemote • Wyoming • United StatesLead💰 $195,000 - $310,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in cloud threat research, detection content lifecycle management, and AI technologies to enhance security operations. Proven ability to lead research initiatives, mentor teams, and translate threat intelligence into actionable detection strategies.

Highest-signal resume keywords

Cloud Threat ResearchDetection Content Lifecycle ManagementAI Technologies UtilizationMITRE ATT&CK FluencyMalware Analysis

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Production Detection Content WritingTelemetry Source AnalysisThreat Intelligence TranslationDetection Strategy ArticulationDetection Efficacy Quantification

Soft Skills

MentoringCollaborationAlignment DrivingTechnical Standards Setting

Tools & Technologies

EDRSIEMLarge Language ModelsCloud Platforms (AWS, Azure, GCP)

Industry Keywords

Cloud SecurityAttack TechniquesPrivilege EscalationIncident ResponseSupply Chain Campaigns

Tech Stack

Tools & technologies

AWSAzureCloudGoogle Cloud PlatformKubernetes

About the role

Key responsibilities & impact

Set research direction across all cloud content and own the technical vision for cloud threat research across control plane, identity, workloads, and Kubernetes on AWS, Azure, and GCP
Lead offensive cloud and attack-path research into novel attack techniques, privilege escalation paths, credential access methods, cross-account and cross-tenant abuse, and identity trust weaknesses
Model attacker chains involving misconfigurations, permissions, and exposures and turn them into detection coverage
Shape agentic red teaming by defining attack techniques, tradecraft, scenarios, attack-path generation and validation, and scoring
Guide agentic detection and response using cloud audit, control-plane telemetry, identity signals, and runtime events
Investigate real cloud intrusions, supply chain campaigns, and emerging tradecraft with Counter Adversary Operations, Office of Adversary Strategy, Falcon Complete, and incident response
Research the AI attack surface involving AI services, model APIs, agent frameworks, and non-human identities
Apply automation and large language models to attack-path discovery, threat intelligence triage, detection prototyping, and validation
Influence product and platform direction by identifying gaps in cloud telemetry, coverage, and platform capabilities
Collaborate with product management, cloud engineering, and platform teams
Publish original research, speak at industry conferences, contribute to open-source and community efforts, and engage with cloud service providers
Mentor researchers and detection engineers and review research, detection logic, and remediation content

Requirements

What you’ll need

Extensive experience writing production detection content across multiple platforms or data domains
Deep understanding of different telemetry sources, their limitations, and where coverage breaks down
Ability to reason about threats spanning endpoint to cloud, identity to SaaS, and network to runtime
Experience designing or contributing to detections that correlate signals across boundaries
Current knowledge of threat actors, campaigns, and TTPs
Ability to translate threat intelligence into detection requirements and prioritization decisions
Experience with detection content lifecycle, including aging rules, false-positive drift, performance cost, and deprecation decisions
Ability to work across multiple teams, drive alignment, and articulate detection strategy to engineers and leadership
Experience guiding or mentoring engineers on detection quality, reviewing detection content at scale, or setting technical standards for a detection engineering function
Proven experience utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes
Ability to periodically undergo and pass additional background and fingerprint checks consistent with government customer requirements
Experience applying AI/LLM to detection or security operations workflows
EDR or SIEM vendor-side product experience
MITRE ATT&CK fluency across multiple platforms
Published security research, including blogs, conference talks, tools, or CVEs
Malware analysis or reverse engineering background
Experience quantifying detection efficacy, including precision, recall, and bypass resistance

Benefits

Comp & perks

Market leader in compensation and equity awards
Comprehensive physical and mental wellness programs
Competitive vacation and holidays for recharge
Paid parental and adoption leaves
Professional development opportunities for all employees regardless of level or role
Employee Networks, geographic neighborhood groups, and volunteer opportunities to build connections
Vibrant office culture with world class amenities
Bonuses
Equity grants
Health insurance
401k
Paid time off