Cybersecurity Threat Hunter - Weekend shift

Microsoft•,

1d•$119,800 - $261,000

About The Position

Microsoft's Detection and Response Team (DART) is seeking a skilled and experienced Cybersecurity Threat Hunter to join its customer-facing incident response team in the United States. DART supports customers during security incidents. In this role, you will identify adversary activity, determine the scope of compromise, and translate findings into clear response actions and recommendations. You will lead evidence-driven, hypothesis-based hunt workstreams across customer environments, establish technical priorities, and partner with customers during urgent response activity. You will work with lead investigators, infrastructure engineers, reverse engineers, and incident coordinators to explain adversary activity, visibility gaps, and lasting security improvements. The role includes analyzing telemetry and forensic artifacts across varied platforms and vendors, developing and improving queries and automation, and converting investigations into detections, mitigations, threat intelligence, and product or architectural improvements. You will also communicate findings and uncertainty to customer technical teams, executives, internal stakeholders, and partners; maintain evidentiary documentation; support post-incident and root-cause analysis; and share research and mentor colleagues. The schedule is Friday through Monday, with a 10-hour shift scheduled between 8:00 a.m. and 6:00 p.m. EDT, including weekends and public holidays. Substitute days off are provided for public holiday work, and hours may change based on business needs.

Requirements

Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or a related field; or a master's degree in one of these fields and 3+ years of relevant experience; or a bachelor's degree in one of these fields and 4+ years of relevant experience; or equivalent experience.
Relevant experience may include software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
Ability to meet Microsoft, customer, and/or government security screening requirements, including the Microsoft Cloud Background Check and any additional checks required for customer or government work.
Ability to work the stated non-standard schedule: Friday through Monday, 10-hour shifts scheduled between 8:00 a.m. and 6:00 p.m. EDT, including weekends and public holidays; hours may change based on business needs.
Demonstrated hands-on experience in threat hunting, Windows forensics, Linux or macOS analysis, or investigating identity-based attacks across Active Directory, Entra ID, or other enterprise identity platforms.
Experience authoring queries against large-scale security telemetry, including scripting or automation.
Ability to correlate and assess evidence from multiple sources, identify compromise scope and visibility gaps, and clearly explain findings and uncertainty.
Strong customer-facing written and verbal communication skills, including executive briefings.

Nice To Haves

Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or a related field and 3+ years of relevant experience; or a master's degree in one of these fields and 6+ years of relevant experience; or a bachelor's degree in one of these fields and 8+ years of relevant experience; or equivalent experience.
Proven hypothesis-led threat hunting at enterprise scale, correlating endpoint, cloud, identity, and network telemetry to identify adversary activity and visibility gaps.
Advanced Kusto Query Language (KQL) skills and ability to transform data at scale.
Forensic capability across Windows, Linux, and macOS, including endpoint artifact and memory analysis where required.
Platform- and vendor-agnostic security experience across Microsoft, AWS, GCP, and third-party SIEM, EDR, identity, network, and email technologies.
Experience leading hunt workstreams in high-pressure, customer-facing incident response while balancing the need for rapid recovery.
Experience converting hunt outcomes into durable detections, analytics, mitigations, and threat intelligence.
Demonstrated technical leadership through research, stakeholder influence, process improvement, and mentoring.
Relevant security certifications or equivalent practical expertise.
Flexibility to work non-standard business hours that may include evenings, nighttime, weekends, and/or holidays.

Responsibilities

Lead evidence-driven hunt workstreams across customer environments, identify adversary activity, and communicate findings, confidence levels, and response recommendations.
Set hunt objectives, hypotheses, priorities, and evidence requirements using threat intelligence, adversary tactics, techniques and procedures, and customer-specific risk context.
Develop, test, and refine hunts using large-scale correlation of endpoint, cloud, identity, network, and third-party telemetry.
Hunt across Windows, Linux, macOS, multi-cloud, and third-party technologies using customer-specific telemetry, forensic artifacts, and security tools.
Determine adversary presence, compromise scope, and visibility gaps; establish known facts, uncertainties, and additional collection or analysis needs.
Author and optimize queries, automation, and responsible AI-enabled workflows to improve hunt scale, analytical quality, and time to detection.
Convert investigations and research into durable detections, analytics, mitigations, threat intelligence, and product or architectural improvements.
Lead multiple hunt workstreams during high-impact incidents, coordinate priorities and dependencies, maintain evidentiary documentation, and support post-incident and root-cause analysis.
Brief customer technical teams, executives, internal stakeholders, and partners on findings, coverage, limitations, and response options.
Provide technical guidance, share research, and mentor other hunters while protecting DART information, tools, and operational security.