Principal Threat Intelligence Analyst CTJ Top Secret

The Cloud & AI organization accelerates Microsofts mission and bold ambitions to ensure that our company and industry is securing digital technology platforms devices and clouds in our customers heterogeneous environments as well as ensuring the security of our own internal estate. Our culture is centered on embracing a growth mindset a theme of inspiring excellence and encouraging teams and leaders to bring their best each doing so we create life-changing innovations that impact billions of lives around the world. Microsoft is one of the largest enterprise service companies in the world.

If you have a deep background in analysis and want to be at the forefront of threat tracking and technique discovery the Microsoft Threat Intelligence Center (MSTIC) wants to hear from you. As a Principal Threat Intelligence Analyst on our team you will obtain real-time visibility into hundreds of simultaneous intrusions and convert this into finished intelligence prioritized judgments and protection at scale. The successful candidate is a critical thinker and problem solver skilled at discovering novel intrusions and adversary tradecraft through analysis and curious enough to pursue impact through product hardening and disruptions where there is no precedent.


Microsofts mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset innovate to empower others and collaborate to realize our shared goals. Each day we build on our values of respect integrity and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

• Discovering and analyzing attacker activity across on-premises and cloud environments.
• Identifying potential threats allowing for proactive defense and customer notification before an actual incident.
• Providing recommendations to improve customers cybersecurity posture going forward and performing threat intelligence knowledge transfer to prepare customers to defend against todays threat landscape.
• Building proof-of-concept and prototype threat hunting tools automations and new capabilities.
• Driving product and tooling improvements by conveying learnings from threat intelligence and intrusion analysis at scale to engineering partner teams.
• Using large-scale query workflows to distill adversary signal within an unparalleled volume of suspicious activity to pivot validate and scope what matters.

Other:

• Embody our companysculture and values.

Required/minimum qualifications

• Doctorate in Computer Science Cybersecurity Intelligence Analysis Mathematics National Security Studies or related field AND 3 years experience in software development lifecycle large-scale computing threat analysis or modeling cybersecurity vulnerability research and/or anomaly detection
  • OR Masters Degree in Computer Science Cybersecurity Intelligence Analysis Mathematics National Security Studies or related field AND 4 years experience in software development lifecycle large-scale computing threat analysis or modeling cybersecurity vulnerability research and/or anomaly detection
  • OR Bachelors Degree in Computer Science Cybersecurity Intelligence Analysis Mathematics National Security Studies or related field AND 6 years experience in software development lifecycle large-scale computing threat analysis or modeling cybersecurity vulnerability research and/or anomaly detection
  • OR equivalent experience.

Other:

Security Clearance Requirements: Candidates must be able to meet Microsoft customer and/or government security screening requirements are required for this role. These requirements include but are not limited to the following specialized security screenings:

The successful candidate must have an active U.S. Government Top Secret Security Clearance. Ability to meet Microsoft customer and/or government security screening requirements are required for this role. Failure to maintain or obtain the appropriate clearance and/or customer screening requirements may result in employment action up to and including termination.

Clearance Verification: This position requires successful verification of the stated security clearance to meet federal government customer requirements. You will be asked to provide clearance verification information prior to an offer of employment.

Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud background check upon hire/transfer and every two years thereafter.

Citizenship & Citizenship Verification: This position requires verification of U.S. citizenship due to citizenship-based legal restrictions. Specifically this position supports United States federal state and/or local United States government agency customer and is subject to certain citizenship-based restrictions where required or permitted by applicable law. To meet this legal requirement citizenship will be verified via a valid passport or other approved documents or verified US government Clearance.

Preferred Qualifications:

• Proven knowledge of security fundamentals across Microsoft platforms (Client Server Cloud) especially identity cloud control planes and enterprise attack paths.
• Understanding of malware tooling and related activity well enough to extract indicators and develop detections for attacker methods. Reverse engineering or detection engineering depth is a plus not a requirement. Curiosity and ingenuity matter as much as years of technical experience.
• Experience producing strategic operational and tactical threat intelligence including actor tracking campaign clustering and analytic writing for technical and executive audiences.
• Familiarity and understanding of SQL or Kusto Query Language (KQL) queries (or experience with large database/SIEM query languages such as Splunk/Humio/Kibana etc.)
• Deep knowledge of endpoint email and cloud forensic log artifacts - or similar experience in analysis of SIEM logs web server logs AV logs and security logs.
• Experience building and reviewing threat hunting automations using scripting languages.
• Experience developing collection requirements judging source reliability and turning raw telemetry and partner reporting into actionable assessments.
• Demonstrated advanced problem solving troubleshooting and analysis skills.

Security Research IC5 - The typical base pay range for this role across the U.S. is USD $142800 - $274800 per year. There is a different range applicable to specific work locations within the San Francisco Bay area and New York City metropolitan area and the base pay range for this role in those locations is USD $188000 - $304200 per year.

Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
position will be open for a minimum of 5 days with applications accepted on an ongoing basis until the position is filled.

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age ancestry citizenship color family or medical care leave gender identity or expression genetic information immigration status marital status medical condition national origin physical or mental disability political affiliation protected veteran or military status race ethnicity religion sex (including pregnancy) sexual orientation or any other characteristic protected by applicable local laws regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process read more about requesting accommodations.

Required Experience:

IC