← All roles

Security Researcher | Defender Experts

Microsoft· Security Research
Apply on company site
Hybrid (Costa Rica)full-timePosted 1w ago

About the role

Security Researchers with experience in security investigations, attacker tradecraft analysis, and signal correlation to analyze complex security data, apply threat-landscape expertise, determine real threats, and provide actionable findings and recommendations for customers. Part of the Defender Experts (DEX) team delivering expert-led cybersecurity investigations at scale.

Responsibilities

  • Analyze and validate security alerts, anomalies, and behavioral patterns within Microsoft 365 Defender and related telemetry to validate detections and understand attacker intent.
  • Apply attacker methodology frameworks (MITRE ATT&CK, Cyber Kill Chain) to contextualize threats, assess progression, and determine potential impact.
  • Investigate identity centric threats, credential misuse, lateral movement, cloud-based attacks, and modern techniques commonly used in human operated ransomware, Business Email Compromise (BEC), and stealthy persistence campaigns.
  • Correlate large and complex datasets using Kusto Query Language (KQL) and investigate tooling to uncover relationships, patterns and root cause.
  • Differentiate benign, misconfigured, suspicious, and malicious activity with confidence, supported by defensible evidence.
  • Deliver customer facing investigation summaries that clearly articulate what occurred, why it matters, and the recommended next steps.

Qualifications

  • Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND at least 2 years of experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection; OR Master's Degree in the same fields AND at least 1 year of experience in the same domains; OR equivalent experience.
  • 3+ years of hands-on experience in one or more of the following areas: Security Operations (SOC Tier 2 or higher); Cybersecurity Investigations; Incident Response (IR); or Threat Hunting.
  • Global collaboration is integral to our work at Microsoft, and proficiency in English is essential for effective communication in this role.
  • Ability to work a consistent schedule from 10:00 AM to 7:00 PM Costa Rica time, aligned to either a Sunday–Thursday or Tuesday–Saturday workweek. The role also requires availability to participate in an on-call rotation, including weekend coverage, to support the Americas’ ongoing operational needs.

Skills

Required:Security investigationsThreat intelligenceKusto Query Language (KQL)
Last updated Oct 16, 2026. Interested? Apply on the company site.

About Microsoft

Cloud ComputingConsumer ElectronicsSoftwareTechnologyliquid-ai-recruiting-target
Company profileWebsite

More open roles at Microsoft