7 days ago
Base Salary
$106k - $223k/yr
Responsibilities
- Own defender-facing exercise content, including workflows, participant tasks, success criteria, and evaluation frameworks.
- Design and maintain reusable hunting content such as KQL quick sheets, investigation playbooks, validation checklists, and hunt guides.
- Translate red-team tactics, techniques, and procedures into detection expectations, telemetry requirements, and validation steps.
- Plan, facilitate, and deliver immersive cybersecurity exercises for U.S. Federal customers.
- Coordinate account teams, customers, delivery stakeholders, red teams, control cells, and intelligence teams.
- Lead after-action analysis and convert exercise findings into detection, response, remediation, and security-operations improvements.
- Track and communicate measurable outcomes such as skill uplift, closed detection gaps, and prioritized remediation guidance.
- Mentor team members and standardize blue-team playbooks, methodologies, and delivery practices.
- Travel approximately 50–75% overnight as required by customers and the business.
Requirements
- Bachelor’s degree in Computer Science, Information Technology, Engineering, Business, Liberal Arts, or a related field and 4+ years of relevant experience, or equivalent experience.
- Active U.S. Government Top Secret/SCI security clearance.
- Ability to satisfy Microsoft, customer, and government security screening requirements, including a Microsoft Cloud background check.
- U.S. citizenship verification is required due to citizenship-based legal restrictions.
- Preferred experience leading or operating in security operations, threat hunting, detection engineering, or incident response.
- Preferred experience designing detection and response workflows, exercise content, investigation processes, playbooks, and evaluation metrics.
- Experience with cloud, identity, hybrid environments, telemetry analysis, detection logic, and visibility-gap assessment is preferred.
- Experience supporting or leading cyber exercises, simulations, or operational training environments is preferred.
- Strong facilitation, mentoring, stakeholder coordination, and technical communication skills are preferred.
- Preferred certifications include Microsoft Security Operations Analyst (SC-200), Azure Security Engineer (AZ-500), GCFR, GCIH, or GCFA.
- Preferred experience level is 8–10 years in blue team operations, threat hunting, detection engineering, or a related role, or equivalent academic/project experience.
Benefits
- Base pay is listed at USD $106,400–$203,600 per year across the U.S., with a separate San Francisco Bay Area and New York City metropolitan area range of USD $137,600–$222,600 per year.
- Certain roles may be eligible for benefits and other compensation.
- The position requires approximately 50–75% overnight travel.
- Applications are accepted on an ongoing basis until the position is filled, with the posting open for at least 5 days.
About Microsoft
Microsoft develops operating systems, productivity software, cloud services, developer tools, and consumer devices for individuals, enterprises, and governments. Its main products include Windows, Microsoft 365, Azure, Visual Studio/GitHub, Xbox, and LinkedIn; revenue comes from software subscriptions and licenses, cloud consumption, hardware sales, and advertising. Founded in 1975 and headquartered in Redmond, Washington, Microsoft is a public company traded on Nasdaq.