The Microsoft Specialized Clouds Vulnerability Research team (STORM) is seeking a Security Research Intern to help strengthen the security visibility of Microsoft’s next-generation cloud platforms. STORM is an offensive security research group focused on identifying vulnerabilities across cutting-edge cloud technologies. As part of our growing Blue Team research efforts, this role will contribute to improving the telemetry, logging, and audit capabilities needed to detect sophisticated attacks. Working alongside security researchers, architects, and engineering teams, you will review products during development, identify gaps in security visibility, and help ensure security monitoring capabilities are built in before products reach customers.This hands-on internship offers significant ownership, mentorship from senior researchers, and exposure to technologies that are not yet publicly available. You will analyze product architectures and threat models, assess and improve security telemetry, validate detection coverage for real-world vulnerabilities, develop automation and hunting capabilities, and collaborate closely with engineering teams to integrate security visibility throughout the product lifecycle. Along the way, you will gain practical experience in cloud security research, detection engineering, threat hunting, telemetry design, distributed systems, Kubernetes security, platform security, and AI-assisted security workflows, while directly contributing to the security of Microsoft’s Sovereign Cloud and Adaptive Cloud platforms.
Responsibilities
Investigate real-world nation state attacks to support the development of high-fidelity protection logic across complex cross-domain kill-chains.
Apply security expertise to analyze massive telemetry sets using big-data query languages (KQL), reasoning over data to identify novel malicious patterns and engineer evidence-based detection rules.
Contribute to the implementation and coding of automated capabilities that autonomously investigate nation state threats, using AI assisted tooling and agentic flows.
Assist in the refinement of protection coverage by analyzing real-world attack telemetry to improve the accuracy and performance of existing detection logics.
Contribute to a strategic feedback loop by documenting findings from attack data analysis to improve overall protection logic and system-wide security posture.
Partner with engineering and product teams to translate research insights into production-ready code, helping to validate protection concepts and ship them at a global scale.
Qualifications
Qualifications
Required
Currently pursuing a B.Sc., M.Sc., or Ph.D. in Computer Science, Computer Engineering, Cybersecurity, or a related technical field, with at least one year remaining before graduation.
Solid understanding of computer science fundamentals, including operating systems, networking, software engineering, and distributed systems concepts.
Experience developing software or automation in one or more modern programming languages (e.g., Python, C#, Go, Java, or C/C++).
Strong analytical and problem-solving skills, with the ability to investigate complex technical systems and identify root causes.
Self-motivated learner who can work independently while collaborating effectively with researchers, security engineers, and product teams.
Preferred
Interest in cloud security, threat hunting, detection engineering, incident response, or Blue Team security research.
Experience analyzing large datasets, logs, telemetry, or security events to identify anomalies and security-relevant patterns.
Familiarity with cloud platforms, Kubernetes, containers, or modern distributed systems architectures.
Understanding of operating system and networking fundamentals, including Windows or Linux internals, authentication, protocols, and security controls.
Experience building automation, security tooling, or using AI-assisted workflows to improve investigations, analysis, or security operations.
Demonstrated passion for security through personal research projects, Capture-the-Flag (CTF) competitions, vulnerability research, open-source contributions, or related activities.
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.
Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.
Skills Required
- Currently pursuing a B.Sc., M.Sc., or Ph.D. in Computer Science, Computer Engineering, Cybersecurity, or a related technical field, with at least one year remaining before graduation.
- Understanding of computer science fundamentals, including operating systems, networking, software engineering, and distributed systems.
- Experience developing software or automation in one or more modern programming languages, such as Python, C#, Go, Java, or C/C++.
- Strong analytical and problem-solving skills, including the ability to investigate complex technical systems and identify root causes.
- Ability to learn independently and collaborate effectively with researchers, security engineers, and product teams.
- Interest in cloud security, threat hunting, detection engineering, incident response, or Blue Team security research.
- Experience analyzing large datasets, logs, telemetry, or security events to identify anomalies and security-relevant patterns.
- Familiarity with cloud platforms, Kubernetes, containers, or modern distributed systems architectures.
- Understanding of Windows or Linux internals, authentication, protocols, and security controls.
- Experience building automation, security tooling, or using AI-assisted workflows for investigations, analysis, or security operations.
- Security experience through personal research projects, Capture-the-Flag competitions, vulnerability research, open-source contributions, or related activities.
Microsoft Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Microsoft and has not been reviewed or approved by Microsoft.
-
Fair & Transparent Compensation — Pay is presented as broadly competitive overall, with clear role/level/location variation and an emphasis on using posted ranges and band information for apples-to-apples comparisons.
-
Retirement Support — Retirement benefits are described as a standout, highlighted by a strong 401(k) match structure and immediate vesting, plus additional plan features for tax-advantaged saving.
-
Parental & Family Support — Family-oriented benefits are portrayed as a meaningful strength, with substantial paid parental leave and added supports like back-up care and adoption/surrogacy assistance.
Microsoft Insights
What We Do
At Microsoft, our mission is to empower every person and every organization on the planet to achieve more. Our mission is grounded in both the world in which we live and the future we strive to create. Today, we live in a mobile-first, cloud-first world, and the transformation we are driving across our businesses is designed to enable Microsoft and our customers to thrive in this world.
