← All roles

Senior Detection Portfolio Engineer

Microsoft· Security Operations Engineering
Apply on company site
Hybrid (United States)$119.8k - $234.7kFull-timePosted 3w ago

About the role

Senior Detection Portfolio Engineer focused on end-to-end detection portfolio ownership within Cyber Defense Operations Detection Engineering. Owns threat actor and partner portfolios, translates investigation findings into production detections, and drives decisions on what to build, who builds it, and how it aligns with portfolio priorities. Hands-on role requiring experience in SOC, threat detection, and collaboration with investigation and hunt teams.

Responsibilities

  • Own an assigned threat actor and partner portfolio end-to-end, including onboarding, offboarding, and tuning decisions, each with explicit written rationale.
  • Partner directly with investigation and hunt leads to translate investigation, hunt, and incident findings into detection ideas, and author high-fidelity detections against those ideas using Kusto and our detection platform.
  • Gate and approve detections and detection ideas and detection submissions from partner teams against our priorities and charter; return ideas that fail gating with clear, actionable rationale and resubmission guidance.
  • Review detections authored by others, including partner-team submissions, for intent fidelity, query performance, and production reliability.
  • Hold the portfolio to an investigator case budget.
  • Make explicit coverage-versus-noise tradeoffs and drive volume down without surrendering coverage on the behaviors that matter.
  • Select, engineer, tune, and leverage AI-assisted and automation frameworks for all aspects of the detection lifecycle: tuning, gating, triage, and investigation.
  • Serve as the primary interface to partner detection teams and to our investigations partners, routing authoring work to the right owner and enforcing the engagement contract.
  • Participate in the detection workstream on-call rotation and lead the detection workstream during incidents: establish whether a detection fired and why, decide whether we author, decide whether we can leverage an existing detection, and drive that work at incident speed.
  • Maintain an evidence-backed view of detection coverage for your portfolio and produce leadership-ready updates on a regular operating rhythm.

Qualifications

  • Doctorate in Statistics, Mathematics, Computer Science, or related field
  • OR Master’s Degree in Statistics, Mathematics, Computer Science, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat modeling, cyber security, anomaly detection, SOC detection, threat analytics, SIEM, IT, or operations incident response
  • OR Bachelor’s Degree in Statistics, Mathematics, Computer Science, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat modeling, cyber security, anomaly detection, SOC detection, threat analytics, SIEM, IT, or operations incident response
  • OR equivalent experience.

Skills

Required:Doctorate or Master’s/ Bachelor's in Statistics, Mathematics, Computer Science, or related fieldExperience in software development lifecycle, large-scale computing, threat modeling, cyber security, anomaly detection, SOC detection, threat analytics, SIEM, IT, or operations incident response
Nice to have:Kusto (KQL) proficiencyThreat actor tradecraft and MITRE ATT&CKAutomation and AI-assisted tooling (Python, notebooks, LLM-based workflows)Ability to operate autonomously and influence others without formal authority

Benefits

  • This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.
Last updated Oct 2, 2026. Interested? Apply on the company site.

About Microsoft

Cloud ComputingConsumer ElectronicsSoftwareTechnologyliquid-ai-recruiting-target
Company profileWebsite

More open roles at Microsoft