| Microsoft Careers

What you'll do

• Own the design of defender-facing content, ensuring alignment with realistic security operations and customer mission requirements.
• Align exercise scope, objectives, and communications with stakeholders; manage blue team operations schedule and represent program in briefings.
• Translate complex technical tradecraft into clear narratives for senior leadership and non-technical stakeholders.
• Drive business outcomes by translating exercise results into actionable recommendations for improving customer security operations.
• Develop and govern defender-facing content to improve detection coverage, response effectiveness, and learning materials post-exercise.

What we're looking for

• Extensive experience in defensive cyber operations within enterprise or U.S. Federal settings.
• Proven ability to design and execute proactive threat hunting and reactive incident response workflows.
• Strong detection engineering skills, including developing and iterating on detection logic and methodologies.
• Expertise in translating operational activity into improved security tradecraft and playbooks.
• Experience leading after-action reports and facilitating knowledge transfer with customer teams.
• Deep understanding of telemetry analysis across various environments (identity, endpoint, network).
• Ability to apply AI/ML and GenAI technologies to enhance defensive cyber operations.