Associate Principal Engineer - Threat Researcher
Bengaluru · 5+ years experience · Full-time · Hybrid · Posted Sep 29, 2026
At a glance
- Experience
- 5+ years experience
- Employment
- Full-time
- Workplace
- Hybrid
- Location
- Bengaluru
About the role
- Saviynt is seeking an Associate Principal Engineer - Threat Researcher to spearhead identity threat research and lead advanced research initiatives.
- The role involves uncovering and understanding novel identity-centric vulnerabilities, attack vectors, and exploit chains across hybrid and multi-cloud environments.
- You will partner closely with Product Managers and Engineering teams to translate complex threat research into actionable product features and robust detection algorithms.
Responsibilities
- Spearhead Identity Threat Research: Lead advanced research initiatives focused on uncovering and understanding novel identity-centric vulnerabilities, exploit chains, and attack vectors across hybrid and multi-cloud environments.
- Data-Driven Behavioral Modeling: Leverage vast telemetry from multi-cloud environments and user activity logs to conduct deep behavioral analysis and develop behavioral models to detect anomalies and identity threat patterns.
- Drive Product Innovation: Partner closely with Product Managers and Engineering teams to translate complex threat research into actionable product features, robust detection algorithms, and high-fidelity telemetry.
- Execute Advanced Threat Hunting & Intelligence: Conduct proactive threat intelligence gathering and sophisticated threat hunting specifically targeting Identity vulnerabilities like Active Directory, Entra ID, Okta, PAM, and Cloud IAM misconfigurations.
- Operationalize Security Frameworks: Extensively utilize and map research to industry-standard frameworks, including MITRE ATT&CK, MITRE ATLAS, and MAESTRO.
- Pioneer Detection Engineering: Architect and develop advanced detection strategies, behavioral baselines, and correlation rules to identify anomalous identity behaviors, privilege escalation, and lateral movement.
- Establish Thought Leadership: Serve as a highly visible ambassador for Saviynt’s research capabilities by authoring and publishing high-quality blogs and technical reports on emerging threats.
- Drive Patentable Innovation: Foster a culture of innovation within the team, actively pursuing research that leads to industry publications, CVE discoveries, and patents for Saviynt.
- Mentor and Guide: Act as a senior technical authority, mentoring junior researchers and elevating the overall technical acumen of the Threat Research and Engineering organizations.
Requirements
- 12+ years of progressive experience in cybersecurity, with a minimum of 5+ years dedicated specifically to Threat Research, Threat Intelligence, or advanced Detection Engineering at a senior/lead level.
- Experience with threat intelligence pivoting, tracing connections between seemingly unrelated data points to attribute attacks to specific threat actors or Advanced Persistent Threats.
- Application of industry models to classify and map adversary behavior, such as MITRE ATT&CK, ATLAS, and MAESTRO.
- Knowledge of Identity based attacks such as Pass-the-Hash/Ticket, Golden/Silver Tickets, MFA Fatigue, Token Theft, Kerberosting and Credential Stuffing.
- Familiarity with tools threat actors use to map and exploit identity environments, such as Mimikatz, BloodHound, Rubeus.
- Assessing zero-day flaws, evaluating proof-of-concept exploits, and testing patching strategies.
- Familiarity with scripting and programming languages such as Python, Go, and Bash.
- Gathering threat intelligence from various sources like Open Source Intelligence, dark web forums, threat feeds, and internal telemetry.
- Creating custom detection logic for monitoring platforms, experience writing detection logic using SIEM query languages like Splunk SPL, KQL, or Sigma.
- A demonstrated track record of thought leadership, including published white papers, cybersecurity blogs, conference speaking engagements, patents, or acknowledged CVEs.
Workplace
- Willing to work in a Hybrid model from the Bengaluru office.
- Willingness to undertake some travel globally based on business requirements, industry conferences, and strategic team syncs.
Skills
- Python
- Go
- Bash
- Splunk SPL
- KQL
- Sigma
- YARA
- Snort
- Mimikatz
- BloodHound
- Rubeus
- Active Directory
Show all 15 skills
- Entra ID
- Okta
- PAM
