Overview The Cloud ability to characterize TTPs, infrastructure, and operational campaigns.
Demonstrated experience producing actionable intelligence that changed the outcome of an investigation or hardened a defended network.
Familiarity with host, log, and network forensics, common protocols, and a range of adversary command-and-control methods.
Demonstrated experience with log analysis and query languages (KQL/Kusto, SQL, or equivalent) across SIEM, identity, endpoint, or cloud telemetry.
Experience with large-scale cloud, identity, and endpoint telemetry.
Experience supporting incident response and familiarity with common IR procedures and tooling.
Ability to communicate findings clearly, with appropriate confidence language, to technical and executive audiences.
Preferred qualifications Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 6+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 8+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity,



vulnerability research, and/or anomaly detection OR equivalent experience.
Background in cloud and identity-based intrusions — token theft, OAuth abuse, SaaS-native tradecraft Detection engineering or hunting query development at scale Use of automation, data science, or AI tooling to accelerate triage, clustering, and analysis Experience delivering customer or executive briefings under time pressure during active incidents Working knowledge of malware used in targeted campaigns, including triage of malicious capabilities.
Familiarity with Microsoft security data sources - MDC, Defender XDR, Sentinel, Azure Resource Graph.
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.
Microsoft is an equal prospect employer.
All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances.
If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about

📌 Senior Security Researcher (Melbourne)
🏢 Microsoft
📍 Melbourne