Security Researcher II

Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

• 1.Conduct proactive threat hunts across endpoint, identity, email, cloud, and other relevant security telemetry to identify indicators of compromise and previously unseen attacker behavior.

• 2. Investigate security alerts and suspicious activity, perform root-cause analysis, and develop a clear understanding of attack scope, sequence, impact, and recommended response.
• 3. Analyze and correlate large, complex datasets to produce timely, context-rich findings and actionable insights for customers and internal partners.
• 4. Apply knowledge of attacker tradecraft, identity systems, authentication and authorization protocols, operating systems, and cloud environments to strengthen investigations and customer defenses.
• 5. Develop and improve high-fidelity hunting queries, detection logic, custom alerts, investigation methods, and response guidance.
• 6. Partner with security researchers, threat intelligence analysts, data scientists, and engineers to convert frontline findings into durable detection and product improvements.
• 7. Document technical findings and communicate complex investigations clearly to both technical and non-technical stakeholders.

• 1. Bachelor's or master's degree in computer science, cybersecurity, engineering, or a related technical field, or equivalent practical experience.
• 2. 3+ years of cybersecurity experience in one or more areas such as security operations, threat hunting, incident response, digital forensics, malware analysis, threat intelligence, penetration testing, or red teaming.
• 3. Hands-on experience investigating security incidents and hunting across large security datasets using SIEM, EDR/XDR, or comparable security platforms.
• 4. Coding or scripting experience with one or more of Python, KQL, SQL, regular expressions, PowerShell, or similar languages.
• 5. Working knowledge of threat analysis models and frameworks such as the Cyber Kill Chain and MITRE ATT&CK.
• 6. Understanding of common enterprise attack surfaces, including endpoints, identity, email, cloud services, networks, and authentication systems.
• 7. Ability to analyze complex technical evidence, form and test hypotheses, and translate findings into clear actions.
• 8. Strong written and verbal communication skills in English, with the ability to brief investigations and collaborate across teams.

1.Experience with Microsoft Defender products, including Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, or the broader Microsoft Defender ecosystem.

2. Experience with digital forensics and incident response, reverse engineering, malware analysis, operating system internals, or security debugging and monitoring tools.

3. Experience with offensive security, exploit development, penetration testing, adversary simulation, OSINT, or common frameworks such as Metasploit.

4. Experience developing detection logic, analytics, custom alerts, hunting tooling, notebooks, visualizations, or security automation.

5. Relevant certifications such as CISSP, OSCP, CEH, or GIAC certifications.

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process.