Defensive Cyber Security Researcher

About the role

The Defensive Cyber Security Researcher joins a new Think Tank group at Novartis, focusing on challenging and strengthening the company’s information security, application security and data protection. The role combines threat hunting, AI‑driven threat analysis and close collaboration with SOC and CTI teams.

Key responsibilities

• Hunt through large volumes of signals to uncover emerging threats, extract indicators of compromise and produce actionable intelligence.
• Conduct deep‑dive investigations, including static and dynamic malware reverse engineering, memory and disk forensics, and produce detailed technical reports.
• Develop and refine detection rules, dashboards and alerts in partnership with the Security Operations Center.
• Research AI‑specific security risks (adversarial ML, prompt injection, data poisoning, shadow AI) and translate findings into defensive guidance.
• Collaborate with Cyber Threat Intelligence teams to operationalise feeds, enrich hunting missions and contribute IOCs, TTPs and adversary profiles.

Required profile

• 5+ years of experience in Incident Response, CERT or malware investigations.
• Strong knowledge of the cyber‑attacker kill chain and AD/Entra ID security, including Kerberoasting, Pass‑the‑Hash, DCSync and BloodHound analysis.
• Proven ability to work with SOC and CTI teams, bridging research depth with operational tempo.
• Solid understanding of AI security risks and experience advising on AI‑related threat exposure.

Required skills

• Threat hunting and detection engineering
• Malware reverse engineering, memory and disk forensics
• Active Directory, Entra ID / Azure AD security
• Python, Perl, Ruby scripting
• Wireshark, Cobalt Strike, Red Team tools
• AI security concepts: adversarial ML, prompt injection, data poisoning, LLM‑assisted attacks