Remote Threat Hunter & MDE/XDR Expert

Tata Consultancy Services; San Jose (CA); On-site; USD 110,000 - 150,000; Full time

Job summary

Tata Consultancy Services in a remote-capable role seeks a seasoned Cybersecurity professional focusing on threat hunting, detection engineering, and incident response. Deep experience with Microsoft Defender for Endpoint and Microsoft 365 Defender is required, along with Splunk SPL and KQL for complex queries.

The role emphasizes translating threat research into actionable detections, building high-fidelity rules with low false positives, mentoring teammates, and collaborating across IR,

Qualifications

• Minimum 5-7 years of experience in cybersecurity with focus on detection, threat hunting, and/or incident response
• At least 2 years of hands-on experience with Microsoft Defender for Endpoint in an enterprise environment
• Demonstrated experience conducting threat hunts that led to actionable security improvements
• Experience supporting or leading security tool migrations or implementations (highly valued)
• Certifications are preferred

Responsibilities

• Perform hypothesis-driven threat hunts and develop high-fidelity detection rules
• Lead or contribute to incident response and forensics efforts
• Translate threat intelligence into practical hunting queries and defenses
• Collaborate with IR, detection engineering, and IT operations across a remote team
• Mentor and train junior staff and build team capability

Skills

Microsoft Defender for Endpoint (MDE)

Microsoft 365 Defender (XDR)

Threat hunting

Incident response

MITRE ATT&CK

Windows internals

Scripting

Communication

Mentoring / teaching

Education

Relevant certifications preferred

Tools

Splunk SPL

KQL (Kusto Query Language)

PowerShell

Python

Active Directory

Job description

Tata Consultancy Services in a remote-capable role seeks a seasoned Cybersecurity professional focusing on threat hunting, detection engineering, and incident response. Deep experience with Microsoft Defender for Endpoint and Microsoft 365 Defender is required, along with Splunk SPL and KQL for complex queries.

The role emphasizes translating threat research into actionable detections, building high-fidelity rules with low false positives, mentoring teammates, and collaborating across IR,