<b>Overview</b><br><p><span style="font-size: 10pt; font-family: arial, helvetica, sans-serif;">Our team builds the intelligence layer that powers Microsoft’s next‑generation threat detection ecosystem—spanning Vortex, Threat Graph, Verdict Net, and campaign‑correlation workflows. We combine deep applied science, graph‑theoretic reasoning, large‑scale machine‑learning, and multi‑modal security analytics to uncover hidden attack patterns across identity, endpoint, network, and cloud. As part of a multidisciplinary organization, we design graph algorithms, develop ML models, operationalize high‑confidence security signals, and partner closely with detection engineering to translate research into customer‑impacting protections. Our work drives core advancements in attack‑path discovery, anomaly detection, graph construction, and threat‑hunting experiences across Microsoft Security.</span></p><br><br><b>Responsibilities</b><br><h2><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Key Responsibilities</span></h2><ul><li><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Machine Learning & Data Science</span></li><li><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Graph Analytics & Threat Reasoning</span></li><li><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Graph Database & Platform Expertise</span></li><li><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Research & Innovation</span></li><li style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Design, train, and deploy supervised/unsupervised ML models for:</span><ul><li style="list-style-type: none;"><ul><li style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">anomaly detection</span></li><li style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">attack pattern discovery</span></li><li style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">similarity scoring</span></li></ul></li></ul></li><li style="font-size: 10pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Build ML pipelines that operate on large‑scale, heterogeneous security telemetry.</span></li><li style="font-size: 10pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Develop graph embeddings, GNN models, clustering, and temporal sequence models to detect emerging threats.</span></li><li style="font-size: 10pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Build and optimize graph traversal algorithms for multi-hop attack path discovery.</span></li><li style="font-size: 10pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Correlate signals across identity, endpoint, network, and cloud domains.</span></li><li style="font-size: 10pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Analyze entities, edges, and temporal relationships to surface hidden attacker behaviors.</span></li><li style="font-size: 10pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Design/optimize graph schemas, ontologies, and semantic layers for threat detection.</span></li><li style="font-size: 10pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Work with graph-native DBs and query languages (e.g., GQL, ADX/Kusto).</span></li><li style="font-size: 10pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Partner with infra teams to scale graph workloads across customer data.</span></li><li style="font-size: 10pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Stay current with academic research and convert novel ML/graph techniques into practical security applications.</span></li><li style="font-size: 10pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Run experimentation cycles (A/B tests, offline evaluation, model validation) to optimize detection precision/recall.</span></li><li><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Discover new attack patterns using clustering, community detection, and probabilistic methods</span>.</li><li><strong><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Cross‑Functional Collaboration</span></strong></li><li style="list-style-type: none;"><ul><li style="list-style-type: none;"><ul><li style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Partner with detection engineering, red teaming, and product teams to integrate ML/graph intelligence into protections.</span></li><li style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Translate complex graph/ML insights into actionable detection logic and SOC‑ready intelligence.</span></li><li style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Communicate findings to security architects and leadership through visualizations, dashboards, and well‑structured narratives.</span></li></ul></li></ul></li></ul><br><br><b>Qualifications</b><br><p><span style="font-size: 10.0pt;"><strong>7+ years</strong> of hands-on experience in applied ML, data science, or security analytics.</span></p><ul><li style="list-style-type: none;"><ul><li style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Strong expertise in one or more of:</span><ul><li style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Graph algorithms, graph databases, GNNs</span></li><li style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Large‑scale ML pipelines</span></li><li style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Unsupervised/behavioral anomaly detection</span></li><li style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Statistical modeling, clustering, embeddings</span></li></ul></li><li style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Deep proficiency in Python, PyTorch/TensorFlow, and data processing frameworks.</span></li><li style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Experience working with large‑scale telemetry (security logs, identity signals, network events, etc.).</span></li><li style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Experience with distributed data systems and query languages (ADX/KQL, Spark, or similar).</span></li><li style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">Strong problem‑solving skills with ability to work on ambiguous research problems.</span></li></ul></li></ul><p style="font-size: 10pt;font-family: arial, helvetica, sans-serif;"><span style="font-size: 10.0pt; font-family: arial, helvetica, sans-serif;">#Msec#</span></p> <br><p>This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.</p><br><hr><br><p>Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about <a href="https://careers.microsoft.com/v2/global/en/accessibility.html"><b><u>requesting accommodations.</u></b></a></p>