Defensive Cyber Security Researcher

About the role

We are looking for a Defensive Cyber Security Researcher to join our advanced threat‑hunting team. You will work closely with the Security Operations Center to uncover emerging threats, analyse malicious activity and strengthen our detection capabilities.

Key responsibilities

• Hunt through large volumes of signals to identify new threats, extract indicators of compromise and produce actionable insights.
• Demonstrate adversary tactics, techniques and procedures (TTPs) using behavioural and signature‑based analysis.
• Participate in hunting missions, leveraging threat intelligence and anomalous log data to detect and eradicate threat actors on the Novartis network.
• Provide expert investigative support for large‑scale security incidents, including static and dynamic malware reverse engineering and memory/disk forensics.
• Produce detailed technical reports and review detection alerts for effectiveness, recommending improvements.
• Develop dashboards and reports with the SOC to highlight suspicious activity, malware, and AI‑related security risks.
• Research AI‑specific threats such as adversarial ML, prompt injection, data poisoning, and shadow AI, translating findings into defensive guidance.
• Collaborate with CTI teams to operationalise intelligence feeds and contribute IOCs, TTPs and adversary profiles.

Required profile

• 5+ years of experience in incident response, CERT, or malware investigations.
• Deep understanding of the cyber‑attacker kill chain and attack objectives.
• Extensive experience with Active Directory, Entra ID/Azure AD security, and related attack paths (Kerberoasting, Pass‑the‑Hash, DCSync, Golden/Silver Ticket).
• Strong knowledge of AI security risks and ability to advise on governance.
• Proven ability to work with SOC teams on detection engineering, alert tuning and high‑severity incident response.

Required skills

• Active Directory
• Azure AD / Entra ID
• BloodHound
• Kerberoasting
• Pass‑the‑Hash
• DCSync
• Golden Ticket
• Silver Ticket
• AI security (adversarial ML, prompt injection, data poisoning, shadow AI)
• Threat hunting
• Malware reverse engineering (static & dynamic)
• Memory forensics
• Disk forensics
• SOC collaboration
• Detection engineering
• Alert tuning
• Threat intelligence integration