Security represents the most critical priorities for our customers in a world awash in digital threats, regulatory scrutiny, and estate complexity. Microsoft Security aspires to make the world a safer place for all. We want to reshape security and empower every user, customer, and developer with a security cloud that protects them with end-to-end, simplified solutions. The Microsoft Security organization accelerates Microsoft’s mission and bold ambitions to ensure that our company and industry is securing digital technology platforms, devices, and clouds in our customers’ heterogeneous environments, as well as ensuring the security of our own internal estate.
Email, chat, and the web are an integral part of our everyday lives. They are essential for communication and productivity; while also providing the primary ways cybercriminals exploit victims and infiltrate organizations. Attackers abuse these communication methods to steal identities through phishing, hold critical assets for ransom, inflict financial harm, disrupt business operations through floods of unsolicited email, and install malicious software.
Do you want to join a team dedicated to protecting hundreds of millions of people from these threats? The Messaging and Web Security Research team is a global, multidisciplinary organization of engineers, data scientists, security researchers, and program managers. With an unparalleled view of the threat landscape, we develop deep expertise in attacker techniques and use that knowledge to fuel innovations using the latest technologies. We protect customers using Outlook.com, Microsoft Defender for O365, Microsoft Edge, and much more.
We are looking for an experienced Security Researcher II to join our dynamic and innovative team. As a Security Researcher II at Microsoft, you’ll play a vital role in analyzing the latest email-based threats (Malware, APT, Phish), writing robust threat detections to mitigate campaigns, and performing deep investigations in response to detection issues faced by Microsoft and our customers. You’ll be working collaboratively with Engineering, Threat Intelligence, and Data Science teams to improve our defense-in-depth capabilities to thwart persistent threats and respond to customer escalations.
Together, we are redefining email and web security using the latest technology, unparalleled data and intelligence systems. Join us and make a difference in our mission to empower everyone to communicate with confidence and trust!
Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

REQUIRED QUALIFICATIONS

• Bachelor’s or Master’s degree in Computer Science, Statistics, Mathematics, or a related field and in-depth experience in email/cyber security, software development lifecycle, large-scale computing, modeling, and/or anomaly detection
• Experience conducting email-based response or threat hunting
• Experience developing tools and automation using common DevOps toolsets and programming languages.

PREFERRED QUALIFICATIONS

• Proficiency in multiple programming and scripting languages: C, C++, C#, Java, Python
• Proficient years of hands-on experience in email or cyber security related roles
• In-depth understanding of detection engineering; and
• Experience working in a geographically distributed operational team

OTHER REQUIREMENTS

Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings:

• Microsoft Cloud Background Check: This position will be required to pass the Microsoft background and Microsoft Cloud background check upon hire/transfer and every two years thereafter.

MSFTSecurity #MSecR #MSSecurity #MSECAIR

Microsoft is an equal opportunity employer. Consistent with applicable law, all qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations

RESPONSIBILITIES

• Document and enrich the understanding of the threat landscape including attacker techniques, emerging trends, and patterns;
• Design and develop novel threat detection techniques or methodologies from creating proof-of-concept to productizing the solution. Write generic and durable threat detections based on Static and Dynamic detection engines;
• Conduct proactive and reactive threat hunting and identify detection issues such as misses or misclassifications from a large-scale dataset;
• Develop and maintain effective monitoring and alerting to proactively identify and respond to emerging threat campaigns or detection anomalies;
• Deep dive investigation of customer’s detection problems and provide an effective and timely mitigation and resolutions;
• Develop and maintain incident response playbooks to improve process and team capabilities;
• Experience working with cloud-based environments, building and maintaining tools/systems with a strong focus on security;
• Build tools and automation to streamline security operations and optimize solutions for engineers;
• Share learnings and knowledge through documentation, brownbag or team meetings to improve overall team’s expertise and capabilities; and
• Availability and willingness to cover a periodic on-call rotation for the team.

Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings:

• Microsoft Cloud Background Check: This position will be required to pass the Microsoft background and Microsoft Cloud background check upon hire/transfer and every two years thereafter