Cybersecurity Threat Hunter
Technology, Data & Digital · IT Infrastructure & Security · Cybersecurity · Software Engineering
In short
Microsoft's Detection and Response Team (DART) is seeking an experienced Cybersecurity Threat Hunter to join their mission-critical team. This remote role involves leading hypothesis-driven hunts, analyzing diverse telemetry, and responding to customer security incidents worldwide. You will collaborate with a global team to identify threats, improve visibility, and shape the future of incident response.
Responsibilities
- Lead evidence-driven hunt workstreams across customer environments.
- Identify adversary activity, determine compromise scope, and communicate clear findings and recommendations.
- Set hunt objectives, hypotheses, priorities, and evidence requirements using threat intelligence and customer-specific risk context.
- Develop, test, and refine hunts using large-scale correlation of endpoint, cloud, identity, network, and third-party telemetry.
- Operate as a platform- and vendor-agnostic hunter across Windows, Linux, macOS, multi-cloud, and third-party technologies.
- Determine adversary presence, compromise scope, and visibility gaps.
- Author and optimize queries, automation, and responsible AI-enabled workflows.
- Convert investigations and research into durable detections, analytics, mitigations, threat intelligence, and product or architectural improvements.
- Lead multiple hunt workstreams during high-impact incidents, coordinate priorities, and maintain evidentiary documentation.
- Brief customer technical teams, executives, internal stakeholders, and partners with clear findings and response options.
- Provide technical guidance, share research, and mentor other hunters.
Requirements
- Doctorate in Statistics, Mathematics, Computer Science, Computer Security or related field OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security or related field AND experience in software development lifecycle, large-scale data analysis or security research; OR equivalent practical cybersecurity experience.
- Demonstrated hands-on experience in threat hunting, Windows forensics, Linux or macOS analysis, or investigating identity-based attacks across Active Directory, Entra ID or other enterprise identity platforms.
- Demonstrated experience authoring queries against large-scale security telemetry, including scripting or automation.
- Ability to correlate and assess evidence from multiple sources, identify compromise scope, assess visibility gaps and clearly explain findings and uncertainty.
- Strong customer-facing written and verbal communication, including executive briefings.
- Flexibility to work non-standard business hours that may include evening, nighttime, weekends and/or holidays.
- Must have or be able to obtain Security Check (SC) or Developed Vetting (DV) clearance.
Desired Qualifications
- Proven hypothesis-led threat hunting at enterprise scale, correlating endpoint, cloud, identity and network telemetry to identify adversary activity and visibility gaps.
- Advanced Kusto Query Language (KQL) skills, with ability to transform data at scale.
- Strong forensic capability across Windows, Linux and macOS, including analysis of endpoint artefacts and memory where required.
- Platform- and vendor-agnostic security experience across Microsoft, AWS, GCP and third-party SIEM, EDR, identity, network and email technologies.
- Experience leading hunt workstreams in high-pressure, customer-facing incident response while balancing the need for rapid recovery.
- Experience converting hunt outcomes into durable detections, analytics, mitigations and threat intelligence.
- Demonstrated technical leadership through research, stakeholder influence, process improvement and mentoring.
- Relevant security certifications or equivalent practical expertise.
Benefits
- Certain roles may be eligible for benefits and other compensation.
- Find additional benefits and pay information here: https://careers.microsoft.com/v2/global/en/corporate-pay/united-kingdom-corporate-pay.html
Skills
Kusto Query LanguageWindows ForensicsLinuxmacOSActive DirectoryEntra IDThreat IntelligenceScriptingAutomationSIEMEDR
#cybersecurity#threat hunting#security research#incident response#forensics#Microsoft#DART#CE&S#remote
About Microsoft
Empowering every person and organization on the planet to achieve more
Every company has a mission. What's ours? To empower every person and every organization to achieve more. We believe technology can and should be a force for good and that meaningful innovation contributes to a brighter world in the future and today. Our culture doesn’t just encourage curiosity; it embraces it. Each day we make progress together by showing up as our authentic selves. We show up with a learn-it-all mentality. We show up cheering on others, knowing their success doesn't diminish our own. We show up every day open to learning our own biases, changing our behavior, and inviting…
Company
MicrosoftJob Posted
3 days ago
Employment Type
Full Time
Work mode
Remote
Salary
£74,700 – £122,600 · Negotiable
Experience Level
Mid-Senior
Locations
United Kingdom
Qualification
Doctoral, Master, No Formal Education
Applicants
Be an early applicant
Similar Jobs
HCLTech
Bangalore, IndiaTrack Lead - Kubernetes, Terraform
Full Time Be an early applicant Posted 4 days ago
HCLTech
Chennai, IndiaTemenos Transact (T24) Senior Product Specialist
Full Time Be an early applicant Posted 4 days ago
HCLTech
Bangalore, IndiaTrack Lead - Kubernetes, Terraform
Full Time Be an early applicant Posted 4 days ago
HCLTech
IndiaTrack Manager - Jenkins,Windows PowerShell
Full Time Be an early applicant Posted 4 days ago
HCLTech
Chennai, IndiaSenior Technical Consultant
Full Time Be an early applicant Posted 4 days ago
HCLTech
Noida, IndiaSr Technical Lead (Support & Operations)
Full Time Be an early applicant Posted 4 days ago