Overview
The Online Forensics team sits within the Microsoft AI Experiences organization, where we protect the monetization network that funds the products people use every day. Because attackers adapt quickly, effective defense must anticipate emerging abuse-not just respond to incidents. You will establish authoritative ground truth on fraud, surface evolving tactics, identify vulnerabilities before they are exploited at scale, and produce the signals, datasets, and test scenarios partner defense teams need.
As a Principal Applied Scientist on the Online Forensics team, you will shape the scientific strategy for protecting Microsoft's monetization network. You will assess threats in monetization and advertising flows and LLM-native systems, track adversary behavior and infrastructure, design safe adversarial simulations, and develop test harnesses and investigation platforms that expose blind spots early. When material incidents occur, you will lead rigorous reconstruction and convert validated findings into labeled ground truth, candidate signals, and regression scenarios that partner defense teams can use to strengthen defenses.
Microsoft's mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.??
Starting January 26, 2026, Microsoft AI (MAI) employees who live within a 50- mile commute of a designated Microsoft office in the U.S. or 25-mile commute of a non-U.S., country-specific location are expected to work from the office at least four days per week. This expectation is subject to local law and may vary by jurisdiction.
Responsibilities
Identify emerging fraud tactics, adversary infrastructure, and evasion patterns across monetization flows and LLM-native systems through threat modeling, behavioral, graph-based, temporal, and cross-surface big data analysis.
Assess high-risk assumptions and attack paths by forming explicit threat hypotheses, identifying observable signals, and validating risk through structured modeling, targeted experiments, and quantitative measurement.
Design safe adversarial simulations that expose blind spots, then convert the results into test harnesses, monitored indicators, and reproducible regression scenarios for sister defense teams.
Establish authoritative ground truth by correlating evidence across accounts, traffic, transactions, providers, devices, and infrastructure; reconstruct attack chains and document their provenance, confidence, scale, and economic exposure.
Develop shared investigation infrastructure, agent-assisted services, and reusable libraries for telemetry analysis, entity resolution, attack-sequence reconstruction, and reproducible case analysis and convert into actionable insights.
When material incidents occur, lead end-to-end reconstruction, document actionable findings, and support the sister teams responsible for remediation and enforcement through validation of closure.
Shape the scientific and technical strategy for monetization fraud intelligence, validation, and investigation capabilities across organizational boundaries.
Embody our Culture and Values.
Qualifications
Required Qualifications:
Bachelor's Degree in Statistics, Econometrics, Computer Science, Electrical or Computer Engineering, or related field AND 6+ years related experience (e.g., statistics, predictive analytics, research)
OR Master's Degree in Statistics, Econometrics, Computer Science, Electrical or Computer Engineering, or related field AND 4+ years related experience (e.g., statistics, predictive analytics, research)
OR Doctorate in Statistics, Econometrics, Computer Science, Electrical or Computer Engineering, or related field AND 3+ years related experience (e.g., statistics, predictive analytics, research)
OR equivalent experience.
Other Requirements:
Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include but are not limited to the following specialized security screenings:
Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud background check upon hire/transfer and every two years thereafter.
Preferred Qualifications:
Master's Degree in Statistics, Econometrics, Computer Science, Electrical or Computer Engineering, or related field AND 9+ years related experience (e.g., statistics, predictive analytics, research)
OR Doctorate in Statistics, Econometrics, Computer Science, Electrical or Computer Engineering, or related field AND 6+ years related experience (e.g., statistics, predictive analytics, research)
OR equivalent experience.
Demonstrated experience proactively identifying and investigating adversarial abuse at web scale through hypothesis-driven analysis of large-scale traffic or transaction telemetry and entity resolution across complex ecosystems.
Demonstrated ability to produce written technical assessments that stand up to scrutiny, stating mechanism, evidence, confidence and economic impact clearly enough for engineering and executive audiences to act on.
Demonstrated experience developing and evaluating machine learning or statistical detection methods on large-scale telemetry, including label validation and measurement of precision, recall, coverage, and drift; and shipping production services or data pipelines using Python and large-data tools such as Spark or SQL.
Direct experience with advertising or monetization fraud ecosystems, including invalid traffic detection, OpenRTB and supply-path mechanics, click and conversion fraud, botnets, device spoofing, residential proxy networks, or synthetic identity abuse.
Red team, offensive security, or adversarial simulation experience, with a track record of designing safe attack simulations and converting findings into reusable regression tests rather than one-off exploits.
Working knowledge of LLM-native attack surfaces and agent-assisted analysis tooling, with experience in relevant methods such as structured threat modeling, graph analysis, anomaly detection, controlled experimentation, attack replay, FMEA, or STPA.
Experience influencing outcomes across organizational boundaries, where the evidence you produce is acted on by teams that own remediation and enforcement rather than by your own team.
MicrosoftAI
abuse
fraud
risk
MAI
Applied Sciences IC5 - The typical base pay range for this role across the U.S. is USD $142,800 - $274,800 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $188,000 - $304,200 per year.
Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
https://careers.microsoft.com/us/en/us-corporate-pay
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.
Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations. (https://careers.microsoft.com/v2/global/en/accessibility.html)
