This list contains only the countries for which job offers have been published in the selected language (e.g., in the French version, only job offers written in French are displayed, and in the English version, only those in English).
Security remains a critical priority for our customers as they navigate growing digital threats, regulatory pressure, and complex estates. Microsoft Security’s mission is to make the world safer by delivering simplified, end‑to‑end solutions that empower every user, customer, and developer. Our organization accelerates Microsoft’s mission by securing digital platforms, devices, and clouds across heterogeneous environments while protecting our own internal estate. We embrace a growth mindset, pursue excellence, and encourage teams to bring their best each day, driving innovations that impact billions worldwide. The Microsoft Defender Experts team is seeking threat hunters to help customers detect, investigate, and respond to advanced attacks using Microsoft 365 Defender. We combine deep knowledge of the attacker landscape with rich telemetry to perform root‑cause analysis, generate high‑fidelity alerts, and ensure no human adversary can operate silently. We leverage Microsoft’s trillions of security signals to identify emerging behaviors, deliver context‑rich detections, build hunting tools and automations, and advance methods for identifying sophisticated tradecraft. Microsoft’s mission is to empower every person and organization to achieve more. We work with a growth mindset, innovate to support others, and collaborate toward shared goals. Our culture—rooted in respect, integrity, and accountability—fosters an inclusive environment where everyone can thrive.
Job Responsibility:
Explore and correlate large data sets to uncover novel and sophisticated attack techniques, monitor and catalog changes in activity group tradecraft, and generate custom alerts for enterprise customers
Work with customer support teams to support investigation and response during an enterprise's time of need
Collaborate with our data science and threat research teams to develop and maintain accurate and durable cloud-based detections
Build hunting tools and automations for use in the discovery of human adversaries
Requirements:
Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
OR equivalent experience
Ability to meet Microsoft, customer and/or government security screening requirements
This position will be required to pass the Microsoft background and Microsoft Cloud background check upon hire/transfer and every two years thereafter
This position requires verification of U.S. citizenship due to citizenship‑based legal restrictions
Nice to have:
Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 6+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 8+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
OR equivalent experience
4+ years of experience in a technical role in the areas of Security Operations, Threat Intelligence, Cyber Incident Response, or Penetration Testing/Red Team
Knowledge of operating system internals and security mechanisms
Experience analyzing attacker techniques that leverage email and cloud-service tactics
Skilled working with extremely large data sets, using tools and scripting languages such as: Excel, SQL, Python, Splunk, and PowerBI
Candidates should have knowledge of operating system internals, security mitigations, and security challenges across Windows, Linux, Mac, Android, and iOS platforms
Familiarity with the kill‑chain model, the MITRE ATT&CK framework, and modern penetration testing techniques is expected
Cross‑group collaboration and communication skills are required, with the ability to clearly articulate the business need for detection improvements
Knowledge of major cloud and productivity platforms, identity systems, and associated security concerns
Experience curating threat intelligence, engaging directly with customers in service delivery roles, and using data to tell a clear story is important
Backgrounds in reverse engineering, DFIR, incident response, or machine learning models are also valuable
Experience with system administration in large enterprise environments—including Windows and Linux systems, network administration, and cloud administration—is preferred
Offensive security experience, including use of tools such as Metasploit, exploit development, OSINT techniques, and designing approaches to test or breach enterprise networks, is beneficial
Advanced technical degrees or cybersecurity certifications such as CISSP, OSCP, CEH, or GIAC are a plus
What we offer:
Benefits and other compensation
Find additional benefits and pay information here: https://careers.microsoft.com/us/en/us-corporate-pay