Security Research Analyst

Responsibilities

• Hunt directly in customer environments with proactive and reactive guidance to detect advanced attacks.
• Explore and correlate large data sets to uncover novel attack techniques and investigate enterprise alerts.
• Work directly with customers at all levels, from analysts to CISOs, to support investigation and response.
• Collaborate with data science and threat research teams to develop and maintain durable detections.
• Leverage AI-powered security tools, Copilot, and agentic workflows to accelerate threat investigations.
• Design, build, and operationalize automations and AI agents for threat hunting and case enrichment.
• Participate in a global security operations model, which may include non-standard business hours.

Requirements

• Experience in cybersecurity, anomaly detection, or a technical role in Security Operations, Threat Intelligence, or Incident Response.
• Proficiency in working with large data sets using tools and scripting languages such as KQL, Python, or Splunk.
• Strong knowledge of the ATT&CK framework and modern attacker tradecraft.
• Ability to work from the Prague office at least three days per week.
• Ability to meet Microsoft and government security screening requirements.

Preferred Qualifications

• Experience leveraging generative AI, large language models, or autonomous agents to improve security operations.
• Experience building automations using orchestration platforms or agent frameworks.
• Advanced knowledge of operating system internals and security mechanisms across Windows, Linux, Mac, and mobile platforms.
• Experience with cloud environments, network signals, and identity systems.
• Advanced technical degrees or cybersecurity certifications such as CISSP, OSCP, CEH, or GIAC.

About the Company

Microsoft Security aspires to make the world a safer place by reshaping security and empowering every user, customer, and developer with an end-to-end security cloud. The Defender Experts for XDR team helps enterprises detect, investigate, and respond to advanced attacks using Microsoft Defender telemetry and AI-enabled workflows.