Security Researcher

Microsoft • In, IN

7d

About The Position

Microsoft Security’s Microsoft Defender Experts (DEX) team combines security expertise with Microsoft security products, telemetry, threat intelligence, and company-wide partnerships to help customers detect, investigate, understand, and respond to advanced threats. Within DEX Operations, Threat Researchers work across customer defense, threat hunting, incident investigation, and detection innovation. The team learns from real-world attacks, turns frontline insights into stronger protection, and improves defenses at global scale.

The Security Researcher will investigate suspicious activity across customer environments, hunt for sophisticated adversaries, perform root-cause analysis, and turn complex security data into clear, actionable protection outcomes. The role uses broad telemetry across the Microsoft Defender ecosystem and other security platforms to identify attacker behavior, uncover detection gaps, and help customers respond. The researcher will develop hunting approaches, detections, and automation alongside experts in security operations, threat intelligence, research, engineering, and data science. Findings may inform immediate customer protection and longer-term product and detection improvements.

Requirements

• Bachelor's or master's degree in computer science, cybersecurity, engineering, or a related technical field, or equivalent practical experience.
• At least 3 years of cybersecurity experience in one or more areas such as security operations, threat hunting, incident response, digital forensics, malware analysis, threat intelligence, penetration testing, or red teaming.
• Hands-on experience investigating security incidents and hunting across large security datasets using SIEM, EDR/XDR, or comparable security platforms.
• Coding or scripting experience with one or more of Python, KQL, SQL, regular expressions, PowerShell, or similar languages.
• Working knowledge of threat analysis models and frameworks such as the Cyber Kill Chain and MITRE ATT&CK.
• Understanding of common enterprise attack surfaces, including endpoints, identity, email, cloud services, networks, and authentication systems.
• Ability to analyze complex technical evidence, form and test hypotheses, and translate findings into clear actions.
• Strong written and verbal communication skills in English, including the ability to brief investigations and collaborate across teams.

Responsibilities

• Conduct proactive threat hunts across endpoint, identity, email, cloud, and other relevant security telemetry to identify indicators of compromise and previously unseen attacker behavior.
• Investigate security alerts and suspicious activity, perform root-cause analysis, and determine attack scope, sequence, impact, and recommended response.
• Analyze and correlate large, complex datasets to produce timely, context-rich findings and actionable insights for customers and internal partners.
• Apply knowledge of attacker tradecraft, identity systems, authentication and authorization protocols, operating systems, and cloud environments to strengthen investigations and customer defenses.
• Develop and improve high-fidelity hunting queries, detection logic, custom alerts, investigation methods, and response guidance.
• Partner with security researchers, threat intelligence analysts, data scientists, and engineers to convert frontline findings into durable detection and product improvements.
• Document technical findings and communicate complex investigations clearly to technical and non-technical stakeholders.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level