Associate Principal Engineer - Threat Researcher

About Saviynt

Role overview

Responsibilities

• Lead research into identity-centric vulnerabilities and attacks involving human, non-human, and agentic identities across hybrid and multi-cloud environments.
• Analyze cloud telemetry, varied data sources, and user activity to develop behavioral models for detecting suspicious identity patterns.
• Translate threat research into product features, detection algorithms, and high-fidelity telemetry with product and engineering teams.
• Hunt threats and gather intelligence on identity vulnerabilities, including Active Directory, Entra ID, Okta, PAM, and Cloud IAM misconfigurations.
• Apply MITRE ATT&CK, MITRE ATLAS, and MAESTRO to detection research and adversary behavior.
• Develop detection strategies, behavioral baselines, and correlation rules for anomalous identity behavior, privilege escalation, and lateral movement.
• Publish technical blogs and reports; pursue research that may result in publications, CVEs, and patents.
• Mentor junior researchers and contribute senior technical guidance to research and engineering teams.

Experience and expertise

• Requires 12+ years of progressive cybersecurity experience.
• Requires at least 5 years in threat research, threat intelligence, or advanced detection engineering at senior or lead level.
• Requires knowledge of identity-based attacks, including Pass-the-Hash/Ticket, Golden/Silver Tickets, MFA fatigue, and token theft.
• Requires threat intelligence pivoting to connect indicators such as IP addresses, domains, and hashes with threat actors or APTs.
• Requires applying frameworks such as MITRE ATT&CK, ATLAS, and MAESTRO to classify adversary behavior.
• Requires knowledge of identity attacks involving human, non-human, and agentic identities.