Principal Cloud Security Researcher (Remote)

As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn’t changed — we’re here to stop breaches, and we’ve redefined modern security with the world’s most advanced AI-native platform. We work on large scale distributed systems, processing almost 3 trillion events per day and this traffic is growing daily.

Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward. We're proud to work for a mission-driven company leveraging AI to transform the way we work. CrowdStrikers drive their careers through flexibility and autonomy while also being expected to contribute to a culture of responsible AI adoption, experimentation, and innovation.

We use an AI-first mindset as a force multiplier to proactively and continuously accelerate execution, build expertise, uncover insights, and solve complex problems. We’re always looking to add talented CrowdStrikers to the team who have limitless passion, a relentless focus on innovation and a fanatical commitment to our customers, our community and each other. Ready to join a mission that matters?

The future of cybersecurity starts with you.

About the Role

Cloud is where the modern breach lives. Adversaries don't need malware to win there: a leaked long-lived key, an over-trusted role, a misconfigured federation, or a poisoned CI/CD pipeline is enough. And they're no longer working by hand.

Threat actors are AI-force-multiplied. They stand up campaigns in hours, enumerate cloud environments at machine speed, and generate permutations on the fly. We need to find, detect, and fix cloud attack paths at the same scale and velocity.

We're building toward that with agentic systems across the full lifecycle: red (agentic red teaming that continuously discovers attack paths in cloud environments), blue (agentic detection and response for cloud), and green (automated remediation, preventive policy, and posture guardrails). We need a research leader who understands all three deeply and can make them work as one system.

This is the senior-most research role for cloud within the Detection Content organization in Threat Detection Platform. It sits within the Cloud Detection team and has high visibility, high impact, and broad mandate: set the research direction for all cloud content, lead the hardest projects personally, and produce original research that moves the product and the industry forward.

You will lead through expertise, technical direction, and influence.

You'll have visibility across one of the largest cloud and identity telemetry footprints in the industry, front-line insight from our threat hunters and incident responders, and a platform that can turn a single research finding into protection for thousands of customers overnight.

What You'll Do

• Set research direction across all cloud content. Own the technical vision for cloud threat research spanning control plane, identity, workloads, and Kubernetes across AWS, Azure, and GCP. Decide where research investment goes, which threat scenarios matter most, and how findings translate into detections, posture checks, and remediation. Have a hand in every major cloud content initiative.
• Lead offensive cloud and attack-path research. Discover novel attack techniques, privilege escalation paths, credential access methods, cross-account and cross-tenant abuse, and identity trust weaknesses before adversaries operationalize them. Model how real attackers chain misconfigurations, permissions, and exposures into breaches, and turn that model into coverage.
• Shape agentic red teaming for Cloud. Provide the adversarial expertise behind our agentic red team capability. Define the attack techniques, tradecraft, and scenarios agents should execute, how attack paths should be generated and validated at scale, and how results should be scored. Make sure our agents think like the most sophisticated cloud attackers.
• Guide agentic detection and response. Translate offensive research and threat intelligence into detection requirements. Advise on detection logic over cloud audit and control-plane telemetry, identity signals, and runtime events. Ensure detections are behavioral, high-fidelity, and resilient to the variation that AI-generated attacks introduce.
• Investigate in-the-wild cloud threats. Partner with Counter Adversary Operations, Office of Adversary Strategy, Falcon Complete, and incident response to analyze real cloud intrusions, supply chain campaigns, and emerging tradecraft. Turn what adversaries are doing today into what our platform detects and prevents tomorrow.
• Research the AI attack surface in the cloud. Investigate how AI services, model APIs, agent frameworks, and non-human identities change cloud risk, and how adversaries are using AI to accelerate attacks. Keep CrowdStrike ahead of the curve as AI adoption outpaces the security foundations beneath it.
• Apply AI/LLM to research workflows. Use automation and large language models to accelerate attack-path discovery, threat intel triage, detection prototyping, and validation. Drive adoption of AI-assisted research practices across the cloud content teams.
• Influence product and platform direction. Identify gaps in cloud telemetry, coverage, and platform capabilities that limit what we can detect and fix. Work with product management, cloud engineering, and platform teams to close them, and help define where the cloud product should go to build a durable competitive edge.
• Be CrowdStrike's voice in cloud security research. Publish original research, speak at industry conferences, contribute to open-source and community efforts, and engage with cloud service providers to responsibly disclose issues and drive secure defaults. Raise the bar for the industry, not just our product.
• Mentor and raise the bar. Coach researchers and detection engineers across cloud teams. Review research, detection logic, and remediation content. Set the standard for what rigorous cloud security research looks like.

What You'll Need:

• Strong detection engineering background. Have extensive experience writing production detection content across multiple platforms or data domains. Deep understanding of different telemetry sources, their limitations, and where coverage breaks down.
• Cross-domain thinking. Demonstrated ability to reason about threats that span multiple surfaces, endpoint to cloud, identity to SaaS, network to runtime. Have designed or contributed to detections that correlate signals across boundaries.
• Threat landscape fluency. Stay current on threat actors, campaigns, and TTPs. Able to translate threat intelligence into detection requirements and prioritization decisions.
• Detection content lifecycle experience. Understand what happens when detection libraries scale, aging rules, FP drift, performance cost, deprecation decisions. Have operated in an environment where detection quality is measured and maintained over time.
• Strong communication and influence. Able to work across multiple teams, drive alignment, and articulate detection strategy to both engineers and leadership. Able to drive outcomes through expertise and relationships.
• Technical leadership. Have guided or mentored engineers on detection quality, reviewed detection content at scale, or set technical standards for a detection engineering function.
• Proven experience utilizing AI technologies to enhance decision-making, streamline workflows and processes, improve efficiency and drive business outcomes.

Bonus Points:

• Experience applying AI/LLM to detection or security operations workflows
• EDR or SIEM vendor-side product experience
• MITRE ATT&CK fluency across multiple platforms
• Published security research (blogs, conference talks, tools, CVEs)
• Malware analysis or reverse engineering background
• Experience quantifying detection effi