This list contains only the countries for which job offers have been published in the selected language (e.g., in the French version, only job offers written in French are displayed, and in the English version, only those in English).
Our team builds the intelligence layer that powers Microsoft’s next-generation threat detection ecosystem—spanning Vortex, Threat Graph, Verdict Net, and campaign-correlation workflows. We combine deep applied science, graph-theoretic reasoning, large-scale machine-learning, and multi-modal security analytics to uncover hidden attack patterns across identity, endpoint, network, and cloud. As part of a multidisciplinary organization, we design graph algorithms, develop ML models, operationalize high-confidence security signals, and partner closely with detection engineering to translate research into customer-impacting protections. Our work drives core advancements in attack-path discovery, anomaly detection, graph construction, and threat-hunting experiences across Microsoft Security.
Job Responsibility:
Design, train, and deploy supervised/unsupervised ML models for: anomaly detection
attack pattern discovery
similarity scoring
Build ML pipelines that operate on large-scale, heterogeneous security telemetry
Develop graph embeddings, GNN models, clustering, and temporal sequence models to detect emerging threats
Build and optimize graph traversal algorithms for multi-hop attack path discovery
Correlate signals across identity, endpoint, network, and cloud domains
Analyze entities, edges, and temporal relationships to surface hidden attacker behaviors
Design/optimize graph schemas, ontologies, and semantic layers for threat detection
Work with graph-native DBs and query languages (e.g., GQL, ADX/Kusto)
Partner with infra teams to scale graph workloads across customer data
Stay current with academic research and convert novel ML/graph techniques into practical security applications
Run experimentation cycles (A/B tests, offline evaluation, model validation) to optimize detection precision/recall
Discover new attack patterns using clustering, community detection, and probabilistic methods
Partner with detection engineering, red teaming, and product teams to integrate ML/graph intelligence into protections
Translate complex graph/ML insights into actionable detection logic and SOC-ready intelligence
Communicate findings to security architects and leadership through visualizations, dashboards, and well-structured narratives
Requirements:
7+ years of hands-on experience in applied ML, data science, or security analytics
Strong expertise in one or more of: Graph algorithms, graph databases, GNNs
Large-scale ML pipelines
Unsupervised/behavioral anomaly detection
Statistical modeling, clustering, embeddings
Deep proficiency in Python, PyTorch/TensorFlow, and data processing frameworks
Experience working with large-scale telemetry (security logs, identity signals, network events, etc.)
Experience with distributed data systems and query languages (ADX/KQL, Spark, or similar)
Strong problem-solving skills with ability to work on ambiguous research problems