Senior Detection Portfolio Engineer

Technology, Data & Digital · IT Infrastructure & Security · Cybersecurity

In short

Microsoft Security is seeking a Senior Detection Portfolio Engineer to join their Cyber Defense Operations team. This role involves owning a portfolio of threat actors and partner platforms, authoring and optimizing detection logic using Kusto (KQL), and making strategic decisions about the detection lifecycle to ensure customer security in a digital threat landscape.

Responsibilities

Own an assigned threat actor and partner portfolio end-to-end, including onboarding, offboarding, and tuning decisions with explicit written rationale.
Partner directly with investigation and hunt leads to translate findings into detection ideas and author high-fidelity detections using Kusto and the detection platform.
Gate and approve detection ideas and submissions from partner teams against priorities and charter.
Review detections authored by others for intent fidelity, query performance, and production reliability.
Hold the portfolio to an investigator case budget.
Make explicit coverage-versus-noise tradeoffs and drive volume down without surrendering coverage on important behaviors.
Select, engineer, tune, and leverage AI-assisted and automation frameworks for the detection lifecycle.
Serve as the primary interface to partner detection teams and investigation partners.
Participate in the on-call rotation and lead the detection workstream during incidents.
Maintain an evidence-backed view of detection coverage for your portfolio and produce leadership-ready updates.

Requirements

Doctorate in Statistics, Mathematics, Computer Science, or related field; OR Master's Degree in Statistics, Mathematics, Computer Science, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat modeling, cyber security, anomaly detection, Security Operations Center (SOC) detection, threat analytics, security incident and event management (SIEM), information technology (IT), or operations incident response; OR Bachelor's Degree in Statistics, Mathematics, Computer Science, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat modeling, cyber security, anomaly detection, Security Operations Center (SOC) detection, threat analytics, security incident and event management (SIEM), information technology (IT), or operations incident response; OR equivalent experience.
Ability to meet Microsoft, customer and/or government security screening requirements.
Must pass the Microsoft Cloud background check upon hire/transfer and every two years thereafter.
Verification of citizenship or other protected status for access to export-controlled information.
Verification of citizenship due to citizenship-based legal restrictions for customers in U.S. federal, state, and/or local government agencies.

Desired Qualifications

3+ years in a security operations role — SOC analyst (Tier 1/2/3), threat hunter, or incident investigator — with direct responsibility for triaging, investigating, and closing real adversary activity.
Demonstrated ability to author production detection logic independently, start to finish, and to optimize existing detections for signal quality and query performance.
Excellent Kusto (KQL) proficiency, including performance tuning against large data lakes.
Working fluency in threat actor tradecraft and MITRE ATT&CK.
Experience making and defending offboarding or deprecation decisions on security controls.
Comfort with detection quality concepts: signal-to-noise ratio, precision, recall, gating criteria, and true-positive validation.
Comfort building and using automation and AI-assisted tooling (Python, notebooks, LLM-based workflows) to scale analysis and detection work, and related tools (Jupyter, Synapse).
Ability to operate with autonomy, influence others without authority, structure unstructured problems, and provide clarity where ambiguity exists.

Benefits

Typical base pay range for this role across the U.S. is USD $119,800 - $234,700 per year.
Base pay range in San Francisco Bay area and New York City metropolitan area is USD $160,200 - $261,000 per year.
Certain roles may be eligible for benefits and other compensation.

Skills

KustoKQLPython

#SecOps#SOC

About Microsoft

Empowering every person and organization on the planet to achieve more

Every company has a mission. What's ours? To empower every person and every organization to achieve more. We believe technology can and should be a force for good and that meaningful innovation contributes to a brighter world in the future and today. Our culture doesn’t just encourage curiosity; it embraces it. Each day we make progress together by showing up as our authentic selves. We show up with a learn-it-all mentality. We show up cheering on others, knowing their success doesn't diminish our own. We show up every day open to learning our own biases, changing our behavior, and inviting…

See all open jobs at Microsoft Read more about Microsoft Website