Cybersecurity Threat Hunter

What you'll do

• Lead hypothesis-driven hunt workstreams to identify adversary activity and determine compromise scope across customer environments.
• Set hunt objectives and priorities using threat intelligence, adversary tactics, and customer-specific risk contexts.
• Develop and refine hunts by correlating endpoint, cloud, identity, network, and third-party telemetry.
• Author and optimize queries, automation, and AI-enabled workflows to improve detection speed and analytical quality.
• Convert investigation findings into durable detections, mitigations, threat intelligence, and architectural improvements.
• Lead multiple hunt workstreams during high-impact incidents while maintaining evidentiary documentation and coordinating priorities.
• Brief customer technical teams and executives on findings, coverage limitations, and response options.
• Provide technical guidance and mentor other hunters while protecting operational security and internal tools.

What we're looking for

• Must have a Doctorate in a relevant field with 3+ years of experience, a Master's with 3+ years, a Bachelor's with 4+ years, or equivalent experience.
• Must be able to meet Microsoft, customer, and government security screening requirements, including a Microsoft Cloud Background Check.
• Must be available to work non-standard shifts from Friday through Monday, including weekends and public holidays.
• Demonstrated hands-on experience in threat hunting, Windows forensics, Linux or macOS analysis, or investigating identity-based attacks (preferred).
• Demonstrated experience authoring queries against large-scale security telemetry, including scripting or automation (preferred).
• Advanced Kusto Query Language (KQL) skills with the ability to transform data at scale (preferred).
• Platform- and vendor-agnostic security experience across Microsoft, AWS, GCP, and third-party SIEM, EDR, and network technologies (preferred).
• Relevant security certifications or equivalent practical expertise (preferred).