Join Microsoft Security's Defender Experts (DEX) team as a Threat Researcher and play a crucial role in safeguarding the world against sophisticated digital threats. This role operates at the intersection of customer defense, threat hunting, and incident investigation, demanding curiosity, collaboration, and resilience.

As a Threat Researcher, you will leverage deep security expertise, Microsoft security products, and extensive telemetry to detect, investigate, and respond to advanced threats. Your work will directly contribute to protecting customers globally by transforming frontline insights into robust defense mechanisms and driving continuous improvements in security operations.

Proactively hunt for indicators of compromise and novel attacker behaviors across endpoint, identity, email, and cloud security telemetry. Investigate security alerts and suspicious activities, conducting thorough root-cause analysis to define attack scope, impact, and recommended responses. Analyze and correlate vast, complex datasets to deliver timely, context-rich findings and actionable intelligence for customers and internal teams. Apply in-depth knowledge of attacker tactics, identity systems, operating systems, and cloud environments to enhance investigations and strengthen customer defenses. Develop and refine high-fidelity hunting queries, detection logic, custom alerts, and investigation methodologies. Collaborate closely with security researchers, threat intelligence analysts, data scientists, and engineers to translate real-world findings into lasting detections and product enhancements. Clearly document technical findings and effectively communicate complex investigations to both technical and non-technical stakeholders.

We seek an experienced Threat Researcher to join the DEX Operations team. You will be instrumental in investigating suspicious activities within customer environments, hunting for sophisticated adversaries, and performing root-cause analysis.

This role requires transforming complex security data into clear, actionable protection outcomes. You will utilize broad telemetry from the Microsoft Defender ecosystem and other security platforms to identify attacker behaviors, reveal detection gaps, and empower customers to respond swiftly and confidently.

The position offers the chance to tackle high-impact security challenges, explore emerging attacker techniques, and develop advanced hunting strategies, detections, and automation. You will collaborate with experts across security operations, threat intelligence, research, engineering, and data science.

Required qualifications include a Bachelor's or Master's degree in a relevant technical field or equivalent practical experience, coupled with 3+ years of cybersecurity experience in areas like security operations, threat hunting, incident response, or digital forensics. Proficiency in scripting languages such as Python, KQL, or PowerShell, and familiarity with threat analysis models like the Cyber Kill Chain and MITRE ATT&CK are essential. Strong analytical and communication skills are also a must.