Senior Cybersecurity Threat Hunter

About the role

Microsoft's Detection and Response Team (DART) is looking for a Senior Cybersecurity Threat Hunter to join its team in Singapore. DART is the first point of contact for many customers during a security incident, and this customer-facing role identifies adversary activity, determines the scope of compromise and turns findings into clear response actions. You will lead hypothesis-driven hunts, set technical priorities and act as a trusted technical partner for customers during urgent response.

Key responsibilities

• Lead evidence-driven hunt workstreams across customer environments, identify adversary activity and communicate clear findings, confidence levels and response recommendations.
• Set hunt objectives, hypotheses, priorities and evidence requirements using threat intelligence, adversary TTPs and customer-specific risk context.
• Develop, test and refine hunts by correlating endpoint, cloud, identity, network and third-party telemetry.
• Determine adversary presence, compromise scope and visibility gaps, and decide what additional collection or analysis is needed.
• Author and optimise queries, automation and AI-enabled workflows to improve scale, quality and time to detection.
• Turn investigations and research into durable detections, analytics, mitigations, threat intelligence and product or architectural improvements.
• Lead hunt workstreams during high-impact incidents, coordinate priorities, maintain evidence documentation and support post-incident and root-cause analysis.
• Brief customer technical teams, executives and partners, and mentor other hunters while protecting DART information and operational security.

Required profile

• Doctorate in Statistics, Mathematics, Computer Science, Computer Security or a related field, or a Master's degree in such a field plus experience in software development, large-scale data analysis or security research; or equivalent practical cybersecurity experience.
• Hands-on experience in threat hunting, Windows forensics, Linux or macOS analysis, or investigating identity-based attacks across Active Directory, Entra ID or similar platforms.
• Experience writing queries against large-scale security telemetry, including scripting or automation.
• Strong written and verbal communication, including executive briefings.
• Ability to work outside standard business hours, including evenings, nights, weekends and public holidays, when needed.
• Security clearance: Microsoft, customer and/or government background checks are required.

Required skills

• Correlating and assessing evidence from multiple sources and explaining findings and uncertainty clearly.
• Preferred: advanced Kusto Query Language (KQL) skills.
• Preferred: strong forensic capability across Windows, Linux and macOS, including memory analysis.
• Preferred: experience with Microsoft, AWS, GCP, SIEM, EDR, identity, network and email technologies.