Cybersecurity Threat Hunter
Technology, Data & Digital · IT Infrastructure & Security · Cybersecurity
In short
As a Cybersecurity Threat Hunter with Microsoft's Detection and Response Team (DART) in the US, you will lead hypothesis-driven hunts to identify adversary activity across customer environments. You will analyze telemetry, determine compromise scope, and provide clear response recommendations, working remotely with a focus on non-standard business hours.
Responsibilities
- Lead evidence-driven hunt workstreams across customer environments, identifying adversary activity and communicating clear findings, confidence, and response recommendations.
- Set hunt objectives, hypotheses, priorities, and evidence requirements using threat intelligence, adversary tactics, techniques, procedures, and customer-specific risk context.
- Develop, test, and refine hunts using large-scale correlation of endpoint, cloud, identity, network, and third-party telemetry.
- Operate as a platform- and vendor-agnostic hunter across Windows, Linux, macOS, multi-cloud, and third-party technologies.
- Determine adversary presence, compromise scope, and visibility gaps; establish what is known, what remains uncertain, and what additional collection or analysis is needed.
- Author and optimize queries, automation, and responsible AI-enabled workflows to improve hunt scale, analytical quality, and time to detection.
- Convert investigations and research into durable detections, analytics, mitigations, threat intelligence, and product or architectural improvements.
- Lead multiple hunt workstreams during high-impact incidents, coordinate priorities and dependencies, maintain evidentiary documentation, and support post-incident and root-cause analysis.
- Brief customer technical teams, executives, internal stakeholders, and partners with clear findings, coverage, limitations, and response options.
- Provide technical guidance, share research, and mentor other hunters while protecting DART information, tools, and operational security.
Requirements
- Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
- OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
- OR equivalent experience.
- Ability to meet Microsoft, customer and / or government security screening requirements.
- Required to work shift assignments during non-standard business hours, Friday through Monday: 10-hour shift scheduled between 8:00 AM - 6 PM EDT, Weekends and Public Holidays.
- Substitute days off will be provided for public holiday work.
- Working hours may change based on business needs.
Desired Qualifications
- Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
- OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 6+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
- OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 8+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
- OR equivalent experience.
- Demonstrated hands-on experience in threat hunting, Windows forensics, Linux or macOS analysis, or investigating identity-based attacks across Active Directory, Entra ID or other enterprise identity platforms.
- Demonstrated experience authoring queries against large-scale security telemetry, including scripting or automation.
- Ability to correlate and assess evidence from multiple sources, identify compromise scope, assess visibility gaps and clearly explain findings and uncertainty.
- Solid customer-facing written and verbal communication, including executive briefings.
- Flexibility to work non-standard business hours that may include evening, nighttime, weekends and/or holidays.
- Proven hypothesis-led threat hunting at enterprise scale, correlating endpoint, cloud, identity and network telemetry to identify adversary activity and visibility gaps.
- Advanced Kusto Query Language (KQL) skills, with ability to transform data at scale.
- Proven forensic capability across Windows, Linux and macOS, including analysis of endpoint artefacts and memory where required.
- Platform- and vendor-agnostic security experience across Microsoft, AWS, GCP and third-party SIEM, EDR, identity, network and email technologies.
- Experience leading hunt workstreams in high-pressure, customer-facing incident response while balancing the need for rapid recovery.
- Experience converting hunt outcomes into durable detections, analytics, mitigations, and threat intelligence.
- Demonstrated technical leadership through research, stakeholder influence, process improvement and mentoring.
- Relevant security certifications or equivalent practical expertise.
Benefits
- Certain roles may be eligible for benefits and other compensation.
- Substitute days off will be provided for public holiday work.
Skills
Kusto Query LanguageWindows ForensicsLinuxmacOSActive DirectoryEntra IDSIEMEDR
#security#threat hunting#incident response#cybersecurity#Microsoft#DART#detection#analysis#cloud#endpoint#identity#network#telemetry#forensics#KQL#Windows#Linux#macOS#Active Directory#Entra ID
About Microsoft
Empowering every person and organization on the planet to achieve more
Every company has a mission. What's ours? To empower every person and every organization to achieve more. We believe technology can and should be a force for good and that meaningful innovation contributes to a brighter world in the future and today. Our culture doesn’t just encourage curiosity; it embraces it. Each day we make progress together by showing up as our authentic selves. We show up with a learn-it-all mentality. We show up cheering on others, knowing their success doesn't diminish our own. We show up every day open to learning our own biases, changing our behavior, and inviting…
Company
MicrosoftJob Posted
4 days ago
Employment Type
Full Time
Work mode
Remote
Salary
US$119,800–234,700 · Negotiable
Experience Level
Mid-Senior
Locations
United States
Qualification
Doctoral, Master, Bachelor
Applicants
Be an early applicant
Similar Jobs
Microsoft
RomaniaSenior Support Engineering Manager
LEI 199–348k/yr Full Time Be an early applicant Posted 4 days ago
Microsoft
RomaniaTechnical Support Advisory IC4
LEI 199–348k/yr Full Time Be an early applicant Posted 4 days ago
Microsoft
RomaniaTechnical Support Engineering Manager
LEI 199–348k/yr Full Time Be an early applicant Posted 4 days ago
Vattenfall
Väröbacka, Sweden +4 moreOperation Engineer
Full Time Be an early applicant Posted 4 days ago
Vattenfall
Forsmark, Sweden +4 moreOperation Engineer
Full Time Be an early applicant Posted 4 days ago
IKEA
London, United KingdomKitchen Production Manager
£37k/yr Full Time Be an early applicant Posted 4 days ago