Senior Detection Portfolio Engineer
Teknik, data och digitalt · IT-infrastruktur och säkerhet · Cybersäkerhet
I korthet
Microsoft Security is seeking a Senior Detection Portfolio Engineer to join their Cyber Defense Operations team. This role involves owning a portfolio of threat actors and partner platforms, authoring and optimizing detection logic using Kusto (KQL), and making strategic decisions about the detection lifecycle to ensure customer security in a digital threat landscape.
Ansvarsområden
- Own an assigned threat actor and partner portfolio end-to-end, including onboarding, offboarding, and tuning decisions with explicit written rationale.
- Partner directly with investigation and hunt leads to translate findings into detection ideas and author high-fidelity detections using Kusto and the detection platform.
- Gate and approve detection ideas and submissions from partner teams against priorities and charter.
- Review detections authored by others for intent fidelity, query performance, and production reliability.
- Hold the portfolio to an investigator case budget.
- Make explicit coverage-versus-noise tradeoffs and drive volume down without surrendering coverage on important behaviors.
- Select, engineer, tune, and leverage AI-assisted and automation frameworks for the detection lifecycle.
- Serve as the primary interface to partner detection teams and investigation partners.
- Participate in the on-call rotation and lead the detection workstream during incidents.
- Maintain an evidence-backed view of detection coverage for your portfolio and produce leadership-ready updates.
Krav
- Doctorate in Statistics, Mathematics, Computer Science, or related field; OR Master's Degree in Statistics, Mathematics, Computer Science, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat modeling, cyber security, anomaly detection, Security Operations Center (SOC) detection, threat analytics, security incident and event management (SIEM), information technology (IT), or operations incident response; OR Bachelor's Degree in Statistics, Mathematics, Computer Science, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat modeling, cyber security, anomaly detection, Security Operations Center (SOC) detection, threat analytics, security incident and event management (SIEM), information technology (IT), or operations incident response; OR equivalent experience.
- Ability to meet Microsoft, customer and/or government security screening requirements.
- Must pass the Microsoft Cloud background check upon hire/transfer and every two years thereafter.
- Verification of citizenship or other protected status for access to export-controlled information.
- Verification of citizenship due to citizenship-based legal restrictions for customers in U.S. federal, state, and/or local government agencies.
Önskade kvalifikationer
- 3+ years in a security operations role — SOC analyst (Tier 1/2/3), threat hunter, or incident investigator — with direct responsibility for triaging, investigating, and closing real adversary activity.
- Demonstrated ability to author production detection logic independently, start to finish, and to optimize existing detections for signal quality and query performance.
- Excellent Kusto (KQL) proficiency, including performance tuning against large data lakes.
- Working fluency in threat actor tradecraft and MITRE ATT&CK.
- Experience making and defending offboarding or deprecation decisions on security controls.
- Comfort with detection quality concepts: signal-to-noise ratio, precision, recall, gating criteria, and true-positive validation.
- Comfort building and using automation and AI-assisted tooling (Python, notebooks, LLM-based workflows) to scale analysis and detection work, and related tools (Jupyter, Synapse).
- Ability to operate with autonomy, influence others without authority, structure unstructured problems, and provide clarity where ambiguity exists.
Förmåner
- Typical base pay range for this role across the U.S. is USD $119,800 - $234,700 per year.
- Base pay range in San Francisco Bay area and New York City metropolitan area is USD $160,200 - $261,000 per year.
- Certain roles may be eligible for benefits and other compensation.
Färdigheter
KustoKQLPython
#SecOps#SOC
Om Microsoft
Empowering every person and organization on the planet to achieve more
Every company has a mission. What's ours? To empower every person and every organization to achieve more. We believe technology can and should be a force for good and that meaningful innovation contributes to a brighter world in the future and today. Our culture doesn’t just encourage curiosity; it embraces it. Each day we make progress together by showing up as our authentic selves. We show up with a learn-it-all mentality. We show up cheering on others, knowing their success doesn't diminish our own. We show up every day open to learning our own biases, changing our behavior, and inviting…
Företag
MicrosoftPublicerade jobb
för 1 månad sedan
Anställningstyp
Heltid
Arbetsform
Distans
Lön
119 800–234 700 US$ / år
Erfarenhetsnivå
Senior
Platser
United States
Kvalifikation
Doktorand, Masterexamen, Kandidatexamen
Sökande
Ansök tidigt
Liknande jobb
Ericsson
Göteborg, SwedenMaster Thesis: Antenna System and Technology
Praktik Ansök tidigt Publicerad för 4 dagar sedan
Arla
Lockerbie, United KingdomSenior Site QEHS Manager
Heltid Ansök tidigt Publicerad för 4 dagar sedan
Scania Group
Södertälje, SwedenSenior Regulatory Engineer - eMobility
Heltid Ansök tidigt Publicerad för 4 dagar sedan
Volvo Group
Göteborg, SwedenSenior Legal Counsel IP
Heltid Ansök tidigt Publicerad för 4 dagar sedan
Qualcomm
Guyancourt, France +1 flerSenior HW IP designer
Heltid Ansök tidigt Publicerad för 4 dagar sedan
Qualcomm
Guyancourt, France +1 flerHW IP designer - Qualcomm - Guyancourt or Sophia, France
Heltid Ansök tidigt Publicerad för 4 dagar sedan