Join Microsoft Security as a Threat Researcher within the Defender Experts (DEX) Operations team. This role is crucial in defending global organizations against evolving digital threats. You will leverage deep security expertise, cutting-edge Microsoft security products, and extensive telemetry to detect, investigate, and respond to advanced threats.

As a key member of the DEX Operations team, you will be at the forefront of customer defense, threat hunting, and incident investigation. Your work will directly contribute to developing innovative detection strategies and enhancing customer protection at a global scale. We are seeking a curious and collaborative individual comfortable navigating uncertainty and transforming frontline insights into robust security solutions.

Proactively conduct threat hunts across endpoint, identity, email, and cloud security telemetry to uncover indicators of compromise and novel attacker behaviors. Investigate security alerts, perform root-cause analysis, and determine the full scope, sequence, and impact of attacks, recommending appropriate responses. Analyze and correlate vast, complex datasets to generate timely, context-rich findings and actionable intelligence for customers and internal stakeholders. Apply expertise in attacker tradecraft, identity systems, authentication/authorization protocols, operating systems, and cloud environments to enhance investigations and customer defenses. Develop and refine high-fidelity hunting queries, detection logic, custom alerts, investigation methodologies, and response guidance. Collaborate with security researchers, threat intelligence analysts, data scientists, and engineers to translate frontline findings into lasting detections and product improvements. Document technical findings meticulously and communicate complex investigations clearly to both technical and non-technical audiences.

A Bachelor's or Master's degree in Computer Science, Cybersecurity, Engineering, or a related technical field, or equivalent practical experience, is required. Possess at least 4 years of cybersecurity experience in areas such as security operations, threat hunting, incident response, digital forensics, malware analysis, threat intelligence, penetration testing, or red teaming. Demonstrate hands-on experience investigating security incidents and performing threat hunts across extensive security datasets using SIEM, EDR/XDR, or similar platforms. Proficiency in coding or scripting using languages like Python, KQL, SQL, regular expressions, or PowerShell. Familiarity with threat analysis models and frameworks, including the Cyber Kill Chain and MITRE ATT&CK. Understanding of common enterprise attack surfaces, encompassing endpoints, identity, email, cloud services, networks, and authentication systems. Ability to analyze complex technical evidence, formulate and test hypotheses, and translate findings into concrete actions. Excellent written and verbal communication skills in English, with the capability to present investigations and collaborate effectively across teams.