[Hiring] Cybersecurity Threat Hunter @Microsoft

Role Description

Microsoft's Detection and Response Team (DART) is seeking a skilled and experienced Cybersecurity Threat Hunter to join the team. DART is the first port of call for many customers during a security incident. This pivotal, customer-facing position identifies adversary activity, determines compromise scope and turns findings into clear response actions.

• Lead hypothesis-driven hunts and establish technical priorities.
• Act as a trusted technical partner for customers during urgent response activity.
• Help customers understand adversary activity, visibility gaps, and durable security improvements.
• Share research, mentor colleagues, and help shape the future of Defender Experts Cybersecurity Incident Response.

Qualifications

• Doctorate in Statistics, Mathematics, Computer Science, Computer Security or related field OR Master's Degree in the same fields AND experience in software development lifecycle, large-scale data analysis or security research; OR equivalent practical cybersecurity experience.
• Demonstrated hands-on experience in threat hunting, Windows forensics, Linux or macOS analysis, or investigating identity-based attacks across Active Directory, Entra ID or other enterprise identity platforms.
• Demonstrated experience authoring queries against large-scale security telemetry, including scripting or automation.
• Ability to correlate and assess evidence from multiple sources, identify compromise scope, assess visibility gaps and clearly explain findings and uncertainty.
• Strong customer-facing written and verbal communication, including executive briefings.
• Flexibility to work non-standard business hours that may include evening, nighttime, weekends and/or holidays.

Requirements

• Proven hypothesis-led threat hunting at enterprise scale, correlating endpoint, cloud, identity and network telemetry to identify adversary activity and visibility gaps.
• Advanced Kusto Query Language (KQL) skills, with ability to transform data at scale.
• Strong forensic capability across Windows, Linux and macOS, including analysis of endpoint artefacts and memory where required.
• Platform- and vendor-agnostic security experience across Microsoft, AWS, GCP and third-party SIEM, EDR, identity, network and email technologies.
• Experience leading hunt workstreams in high-pressure, customer-facing incident response while balancing the need for rapid recovery.
• Experience converting hunt outcomes into durable detections, analytics, mitigations and threat intelligence.
• Demonstrated technical leadership through research, stakeholder influence, process improvement and mentoring.
• Relevant security certifications or equivalent practical expertise.

Security Clearance Requirements

• The successful candidate must have or be able to obtain the Security Check (SC) or Developed Vetting (DV) clearance as issued by the United Kingdom Security Vetting Unit (UKSV).
• Ability to meet Microsoft, customer and/or government security screening requirements are required for this role.

Benefits

• Typical base pay range for this role across United Kingdom is £74,700.00 - £122,600.00 per year.
• Certain roles may be eligible for benefits and other compensation.
• Find additional benefits and pay information here .