Senior Cyber Threat Hunter: Incident Response Leader

microsoft operations pte ltd; Singapore; On-site; SGD 150,000 - 210,000; Full time

Job summary

Microsoft is seeking a Cybersecurity Threat Hunter in Singapore within DART to lead hypothesis-driven hunts across customer environments. You will identify adversary activity, determine scope and communicate findings with clear response actions, mentoring others and shaping durable security improvements.

The role requires hands-on threat hunting across Windows, Linux, macOS, and multi-cloud environments, with strong scripting, telemetry analysis, and executive briefing abilities.

Qualifications

• PhD or MS in CS, security or related field with practical cybersecurity experience.
• Hands-on threat hunting experience and knowledge of enterprise identity platforms.
• Experience authoring queries against large-scale telemetry and scripting/automation.
• Strong written and verbal communication, including executive briefings.
• Willingness to work outside standard hours based on business needs.

Responsibilities

• Lead evidence-driven hunt workstreams across customer environments.
• Develop, test and refine hunts using endpoint, cloud, identity and network telemetry.
• Operate platform- and vendor-agnostic hunts across Windows, Linux, macOS, multi-cloud.
• Coordinate priorities and document evidentiary findings during incidents.
• Brief customers and internal stakeholders with clear findings and response options.

Skills

Threat hunting

Windows forensics

Executive briefing

Scripting/automation

Communication skills

Education

PhD in CS/Security/related field

MS in CS/Security/related field

Tools

KQL (Kusto)

SIEM

EDR

Job description

Microsoft is seeking a Cybersecurity Threat Hunter in Singapore within DART to lead hypothesis-driven hunts across customer environments. You will identify adversary activity, determine scope and communicate findings with clear response actions, mentoring others and shaping durable security improvements.

The role requires hands-on threat hunting across Windows, Linux, macOS, and multi-cloud environments, with strong scripting, telemetry analysis, and executive briefing abilities.