Join Microsoft Security and contribute to making the world safer in an era of advanced digital threats. The Microsoft Defender Experts (DEX) team is seeking an experienced Threat Researcher to investigate suspicious activities, hunt for sophisticated adversaries, and transform complex security data into actionable protection. This role offers a unique opportunity to work on high-impact security challenges, explore emerging attacker techniques, and collaborate with a world-class team of security professionals.

As a Threat Researcher, you will leverage broad telemetry across the Microsoft Defender ecosystem and other security platforms. You will identify attacker behaviors, uncover detection gaps, and empower customers to respond swiftly and confidently to threats. Your discoveries will directly influence immediate customer protection and contribute to long-term product and detection improvements.

Proactively conduct threat hunts across endpoint, identity, email, cloud, and other security telemetry to identify indicators of compromise and novel attacker behaviors. Investigate security alerts and suspicious activities, perform root-cause analysis, and clearly define attack scope, sequence, impact, and recommended responses.

Analyze and correlate vast, complex datasets to deliver timely, context-rich findings and actionable insights for customers and internal partners. Apply expertise in attacker tradecraft, identity systems, authentication/authorization protocols, operating systems, and cloud environments to enhance investigations and customer defenses.

Develop and refine high-fidelity hunting queries, detection logic, custom alerts, investigation methodologies, and response guidance. Collaborate with security researchers, threat intelligence analysts, data scientists, and engineers to translate frontline findings into durable detections and product enhancements.

Clearly document technical findings and effectively communicate complex investigations to both technical and non-technical stakeholders.

A Bachelor's or Master's degree in Computer Science, Cybersecurity, Engineering, or a related technical field, or equivalent practical experience is required. Candidates should possess a minimum of 3 years of cybersecurity experience in areas such as security operations, threat hunting, incident response, digital forensics, malware analysis, threat intelligence, penetration testing, or red teaming.

Demonstrated hands-on experience investigating security incidents and hunting across large security datasets using SIEM, EDR/XDR, or comparable security platforms. Proficiency in coding or scripting with languages like Python, KQL, SQL, regular expressions, or PowerShell is essential.

Working knowledge of threat analysis models and frameworks, including the Cyber Kill Chain and MITRE ATT&CK, is necessary. A solid understanding of common enterprise attack surfaces, encompassing endpoints, identity, email, cloud services, networks, and authentication systems, is expected. The ability to analyze complex technical evidence, formulate and test hypotheses, and translate findings into clear actions is crucial. Strong written and verbal communication skills in English are required for briefing investigations and collaborating across teams.