Senior Data Scientist, Data Science

Our team builds the intelligence layer that powers Microsoft's next‑generation threat detection ecosystem—spanning Vortex, Threat Graph, Verdict Net, and campaign‑correlation workflows. We combine deep applied science, graph‑theoretic reasoning, large‑scale machine‑learning, and multi‑modal security analytics to uncover hidden attack patterns across identity, endpoint, network, and cloud. As part of a multidisciplinary organization, we design graph algorithms, develop ML models, operationalize high‑confidence security signals, and partner closely with detection engineering to translate research into customer‑impacting protections. Our work drives core advancements in attack‑path discovery, anomaly detection, graph construction, and threat‑hunting experiences across Microsoft Security. Machine Learning & Data Science Graph Database & Platform Expertise Design, train, and deploy supervised/unsupervised ML models for: Build ML pipelines that operate on large‑scale, heterogeneous security telemetry. Correlate signals across identity, endpoint, network, and cloud domains. Work with graph-native DBs and query languages (e.g., Partner with infra teams to scale graph workloads across customer data. Stay current with academic research and convert novel ML/graph techniques into practical security applications. Run experimentation cycles (A/B tests, offline evaluation, model validation) to optimize detection precision/recall. Discover new attack patterns using clustering, community detection, and probabilistic methods. Partner with detection engineering, red teaming, and product teams to integrate ML/graph intelligence into protections. Translate complex graph/ML insights into actionable detection logic and SOC‑ready intelligence. 7+ years of hands-on experience in applied ML, data science, or security analytics. Graph algorithms, graph databases, GNNs Large‑scale ML pipelines Deep proficiency in Python, PyTorch/TensorFlow, and data processing frameworks. Experience working with large‑scale telemetry (security logs, identity signals, network events, etc.). Experience with distributed data systems and query languages (ADX/KQL, Spark, or similar). This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled. Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.