Microsoft Security is committed to making the world safer in an era of rapidly evolving digital threats and determined human adversaries. The Microsoft Defender Experts (DEX) team combines deep security expertise with Microsoft security products, telemetry, threat intelligence, and partnerships across the company to help customers detect, investigate, understand, and respond to advanced threats.
Within DEX Operations, Threat Researchers operate where customer defense, threat hunting, incident investigation, and detection innovation meet. We are curious, collaborative, and comfortable working through uncertainty. We learn from real-world attacks, turn frontline insights into stronger protection, and continuously improve how we defend customers at global scale.
We are looking for an experienced Threat Researcher to join the DEX Operations team. You will investigate suspicious activity across customer environments, hunt for sophisticated adversaries, perform root-cause analysis, and transform complex security data into clear, actionable protection outcomes. You will use broad telemetry across the Microsoft Defender ecosystem and other security platforms to identify attacker behavior, surface detection gaps, and help customers respond quickly and confidently.
This role offers the opportunity to work on high-impact security challenges, explore emerging attacker tradecraft, and build hunting approaches, detections, and automation with experts across security operations, threat intelligence, research, engineering, and data science. The work is technically demanding and constantly evolving. Your discoveries can influence immediate customer protection as well as longer-term product and detection improvements.
Responsibilities
Conduct proactive threat hunts across endpoint, identity, email, cloud, and other relevant security telemetry to identify indicators of compromise and previously unseen attacker behavior.
Investigate security alerts and suspicious activity, perform root-cause analysis, and develop a clear understanding of attack scope, sequence, impact, and recommended response.
Analyze and correlate large, complex datasets to produce timely, context-rich findings and actionable insights for customers and internal partners.
Apply knowledge of attacker tradecraft, identity systems, authentication and authorization protocols, operating systems, and cloud environments to strengthen investigations and customer defenses.
Develop and improve high-fidelity hunting queries, detection logic, custom alerts, investigation methods, and response guidance.
Partner with security researchers, threat intelligence analysts, data scientists, and engineers to convert frontline findings into durable detection and product improvements.
Document technical findings and communicate complex investigations clearly to both technical and non-technical stakeholders.
Qualifications
Global mission: Help defend enterprise customers around the world against sophisticated and fast-moving threats.
Cutting-edge work: Investigate emerging adversary behavior and solve security problems that do not yet have established playbooks.
Latest technology: Work with rich Microsoft security telemetry, modern security analytics, threat intelligence, cloud-scale data, automation, and evolving AI-assisted capabilities.
End-to-end impact: Connect live customer investigations to better hunting, stronger detections, improved operational workflows, and product feedback.
Expert community: Collaborate with specialists across Microsoft Security and learn from diverse perspectives in research, operations, engineering, data science, and incident response.
Continuous challenge: Expand your skills across platforms, attack surfaces, and adversary techniques while making decisions in ambiguous, high-impact situations.
Required qualifications
Bachelor's or master's degree in computer science, cybersecurity, engineering, or a related technical field, or equivalent practical experience.
3+ years of cybersecurity experience in one or more areas such as security operations, threat hunting, incident response, digital forensics, malware analysis, threat intelligence, penetration testing, or red teaming.
Hands-on experience investigating security incidents and hunting across large security datasets using SIEM, EDR/XDR, or comparable security platforms.
Coding or scripting experience with one or more of Python, KQL, SQL, regular expressions, PowerShell, or similar languages.
Working knowledge of threat analysis models and frameworks such as the Cyber Kill Chain and MITRE ATT&CK.
Understanding of common enterprise attack surfaces, including endpoints, identity, email, cloud services, networks, and authentication systems.
Ability to analyze complex technical evidence, form and test hypotheses, and translate findings into clear actions.
Strong written and verbal communication skills in English, with the ability to brief investigations and collaborate across teams.
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.
Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.
Skills Required
- Bachelor's or master's degree in computer science, cybersecurity, engineering, or a related technical field, or equivalent practical experience
- 3+ years of cybersecurity experience in security operations, threat hunting, incident response, digital forensics, malware analysis, threat intelligence, penetration testing, or red teaming
- Hands-on experience investigating security incidents and hunting across large security datasets using SIEM, EDR/XDR, or comparable security platforms
- Coding or scripting experience with Python, KQL, SQL, regular expressions, PowerShell, or similar languages
- Working knowledge of the Cyber Kill Chain and MITRE ATT&CK
- Understanding of enterprise attack surfaces including endpoints, identity, email, cloud services, networks, and authentication systems
- Ability to analyze complex technical evidence, form and test hypotheses, and translate findings into clear actions
- Strong written and verbal communication skills in English
Microsoft Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Microsoft and has not been reviewed or approved by Microsoft.
-
Fair & Transparent Compensation — Pay is presented as broadly competitive overall, with clear role/level/location variation and an emphasis on using posted ranges and band information for apples-to-apples comparisons.
-
Retirement Support — Retirement benefits are described as a standout, highlighted by a strong 401(k) match structure and immediate vesting, plus additional plan features for tax-advantaged saving.
-
Parental & Family Support — Family-oriented benefits are portrayed as a meaningful strength, with substantial paid parental leave and added supports like back-up care and adoption/surrogacy assistance.
Microsoft Insights
What We Do
At Microsoft, our mission is to empower every person and every organization on the planet to achieve more. Our mission is grounded in both the world in which we live and the future we strive to create. Today, we live in a mobile-first, cloud-first world, and the transformation we are driving across our businesses is designed to enable Microsoft and our customers to thrive in this world.
