Security Researcher – Defender Experts

About the role

Microsoft Security’s Defender Experts (DEX) team is looking for experienced Security Researchers to conduct deep investigations of complex security data, apply threat‑landscape expertise and deliver actionable findings that protect customers worldwide.

Key responsibilities

• Analyze and validate security alerts, anomalies, and behavioral patterns within Microsoft 365 Defender and related telemetry.
• Apply attacker methodology frameworks such as MITRE ATT&CK and the Cyber Kill Chain to contextualize threats and assess impact.
• Investigate identity‑centric threats, credential misuse, lateral movement, cloud‑based attacks and modern ransomware techniques.
• Correlate large datasets using Kusto Query Language (KQL) to uncover relationships, patterns and root causes.

Required profile

• Bachelor’s degree in a quantitative field or equivalent experience, with at least 2 years in security operations, investigations, incident response or threat hunting.
• Proven experience analyzing alerts and telemetry from EDR/XDR platforms, preferably Microsoft 365 Defender.
• Ability to work a consistent schedule from 10:00 AM to 7:00 PM Costa Rica time and participate in on‑call rotation.

Required skills

• Kusto Query Language (KQL)
• MITRE ATT&CK framework
• Cyber Kill Chain methodology
• Microsoft 365 Defender components (Endpoint, Identity, Cloud Apps, Email Protection)
• Operating system internals for Windows, Linux and macOS
• Cloud platforms: Azure, AWS, GCP
• Identity‑based attack techniques (OAuth abuse, token theft, Kerberos/NTLM anomalies, conditional access bypass)
• Offensive tools such as Metasploit, exploit development and OSINT