Role at a glance
- Job function
-
Software Engineering & IT Cybersecurity
- Salary
- $160.2K – $261K/yr
- Location
- Redmond, Washington, United States
- Work arrangement
- On-site
- Employment
- Full-time
- Experience
- Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 4+ years experience in software...
- Education
- Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 4+ years experience in software...
- Visa support
- The successful candidate must have an active U.S. Government Secret Security Clearance. ... This position requires verification of U.S....
Spotted an issue?
We’ll check it against the original posting.
Role Summary
The Applied Intelligence Analyst role applies Microsoft Threat Intelligence Center intelligence to investigations across Microsoft products, services, and customer environments. It combines threat intelligence and incident response, with a focus on attribution, emerging adversary activity, and actionable intelligence.
What You'll Do
- Provide threat intelligence expertise to proactive security research and reactive incident response investigations.
- Collect, model, attribute, and document intelligence, leading threat actor attribution efforts in partnership with incident response teams.
- Deliver intelligence and attribution insights that support detection, investigation, and remediation of advanced threats.
- Translate adversary activity, exploitation techniques, and emerging attack trends into recommendations for product and service security...
- Identify emerging adversary activity, develop new threat clusters into tracked actor groups, and analyze activity using the Diamond...
- Communicate intelligence through reports, executive briefings, and customer presentations, and share investigation findings with MSTIC...
Generated from the employer's posting. Verify important details before applying.
View full postingQualifications
Required: a bachelor's degree in a related field with 4+ years of specified experience, or a master's degree in a related field with 3+ years, or a doctorate in a related field, or equivalent experience. The role also requires an active U.S. Government Secret Security Clearance and the ability to meet required security screenings.
Preferred
- Preferred: Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 8+ years experience...
- Background in cloud and identity-based intrusions, including token theft, OAuth abuse, and SaaS-native tradecraft.
- Detection engineering or hunting query development at scale.
- Use of automation, data science, or AI tooling to accelerate triage, clustering, and analysis.
- Experience delivering customer or executive briefings under time pressure during active incidents.
- Working knowledge of malware used in targeted campaigns, including triage of malicious capabilities.
- Familiarity with Microsoft security data sources: MDC, Defender XDR, Sentinel, and Azure Resource Graph.
- Strong technical knowledge of adversary capabilities, infrastructure, and techniques, and ability to develop methods to discover and...
Original job description
Content provided by the employer
Original job description
Content provided by the employer
Responsibilities
- Support high-impact investigations by providing threat intelligence expertise to both proactive security research initiatives and reactive incident response engagements across Microsoft and customer environments.
- Lead attribution and threat actor analysis by collecting, modeling, attributing, and documenting intelligence gathered during investigations. Serve as the primary owner for attribution efforts while partnering with incident response teams responsible for forensics and customer engagement.
- Enable Microsoft Security teams by delivering actionable intelligence and attribution insights that support the detection, investigation, and remediation of advanced threats across Microsoft's security ecosystem.
- Drive product and service improvements by translating intelligence on adversary activity, exploitation techniques, and emerging attack trends into recommendations that strengthen the security of Microsoft's products and services.
- Identify and track emerging threats by discovering previously untracked adversary activity, developing new threat clusters into tracked actor groups, and conducting deep analysis across the Diamond Model and multiple Microsoft telemetry sources to advance Microsoft's understanding of the threat landscape.
- Communicate intelligence to diverse audiences through written reports, executive briefings, and customer-facing presentations. Support customer notifications related to imminent, ongoing, or impactful threat activity.
- Strengthen the intelligence feedback loop by ensuring insights gained during investigations, including novel capabilities, infrastructure, targeting patterns, and tradecraft, are rapidly shared with Microsoft Threat Intelligence Center (MSTIC) tracking teams to improve detection, attribution, and future investigations.
Qualifications
Required/Minimum Qualifications
- Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection,
- OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
- OR Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field
- OR equivalent experience.
Other Requirements:
Security Clearance Requirements: Candidates must be able to meet Microsoft, customer and/or
government security screening requirements as required for this role. These requirements include, but
are not limited to the following specialized security screenings:
- The successful candidate must have an active U.S. Government Secret Security Clearance. Ability
to meet Microsoft, customer and/or government security screening requirements are required for
this role. Failure to maintain or obtain the appropriate clearance and/or customer screening
requirements may result in employment action up to and including termination. - Clearance Verification: This position requires successful verification of the stated security
clearance to meet federal government customer requirements. You will be asked to provide
clearance verification information prior to an offer of employment. - Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud
background check upon hire/transfer and every two years thereafter. - Citizenship & Citizenship Verification: This position requires verification of U.S. citizenship due
to citizenship-based legal restrictions. Specifically, this position supports United States federal,
state, and/or local United States government agency customer and is subject to certain
citizenship-based restrictions where required or permitted by applicable law. To meet this legal
requirement, citizenship will be verified via a valid passport, or other approved documents, or
verified US government Clearance
Preferred qualifications
- Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 8+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
- OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 6+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
- OR Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
- OR equivalent experience
- Background in cloud and identity-based intrusions — token theft, OAuth abuse, SaaS-native tradecraft
- Detection engineering or hunting query development at scale
- Use of automation, data science, or AI tooling to accelerate triage, clustering, and analysis
- Experience delivering customer or executive briefings under time pressure during active incidents
- Working knowledge of malware used in targeted campaigns, including triage of malicious capabilities.
- Familiarity with Microsoft security data sources - MDC, Defender XDR, Sentinel, Azure Resource Graph.
- Strong technical knowledge of adversary capabilities, infrastructure, and techniques, and the ability to develop new methods to discover and track them.
- Experience tracking advanced financially motivated or state-sponsored adversaries using the Diamond Model; ability to characterize TTPs, infrastructure, and operational campaigns.
- Demonstrated experience producing actionable intelligence that changed the outcome of an investigation or hardened a defended network.
- Familiarity with host, log, and network forensics, common protocols, and a range of adversary command-and-control methods.
- Demonstrated experience with log analysis and query languages (KQL/Kusto, SQL, or equivalent) across SIEM, identity, endpoint, or cloud telemetry.
- Experience with large-scale cloud, identity, and endpoint telemetry.
- Experience supporting incident response and familiarity with common IR procedures and tooling.
- Ability to communicate findings clearly, with appropriate confidence language, to technical and executive audiences.
Security Research IC4 - The typical base pay range for this role across the U.S. is USD $119,800 - $234,700 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $160,200 - $261,000 per year.
Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
https://careers.microsoft.com/us/en/us-corporate-pay
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.
Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.
About the company
Microsoft
Large Enterprise
Microsoft is a global technology leader that empowers individuals and organizations to achieve more through innovative software, services, and devices. Founded in 1975, the company is best known for its flagship products like the Windows operating system and Microsoft Office suite. In addition to personal computing, Microsoft is a leader in cloud computing with its Azure platform, providing a range of solutions for businesses to enhance productivity and efficiency. With a strong commitment to sustainability and accessibility, Microsoft continues to drive technological advancements that shape the future of work and learning.