Security is one of the most critical priorities for customers navigating an increasingly complex landscape of digital threats regulatory requirements and rapidly evolving technology environments. Microsoft Security is committed to making the world a safer place by empowering every user customer and developer with a comprehensive security cloud that delivers end-to-end protection through simplified integrated solutions.

As part of Microsofts Cloud & AI organization we advance Microsofts mission to secure digital technology platforms devices applications and cloud environments for customers worldwide while also protecting Microsofts own global infrastructure. Our culture is built on a growth mindset a commitment to excellence and a belief that diverse perspectives drive innovation. Together we create technologies that positively impact billions of people around the world.

Do you have a passion for helping organizations defend themselves against sophisticated cyber threats Are you energized by the opportunity to work at the forefront of the threat intelligence and security industry Do you want to play a direct role in protecting Microsoft and its customers from advanced adversaries If so consider joining the Applied Intelligence team as an Applied Intelligence Analyst.

As an Senior Applied Intelligence Researcher you will apply the Microsoft Threat Intelligence Centers (MSTIC) intelligence to active investigations across Microsofts products services and customer environments. Operating at the intersection of threat intelligence and incident response you will enrich investigations with threat actor context drive attribution efforts produce actionable intelligence identify emerging adversary activity and contribute to Microsofts threat actor tracking mission.

In this role you will collaborate closely with incident response threat intelligence and product teams across Microsoft including organizations such as GHOST and DART to help protect both Microsoft and its customers. You will leverage intelligence-driven insights to support investigations strengthen strategic partnerships and build new relationships with key stakeholders to advance Microsofts security objectives and deliver meaningful impact for customers worldwide.

At Microsoft our missionto empower every person and every organization on the planet to achieve moreguides how we partner with customers to deliver trusted impactful solutions. With a growth mindset culture we innovate responsibly and measure success by shared progresspeople teams and customers. Join us to do meaningful work that changes the world and helps shapewhatsnext for everyone.

• Support high-impact investigations by providing threat intelligence expertise to both proactive security research initiatives and reactive incident response engagements across Microsoft and customer environments.
• Lead attribution and threat actor analysis by collecting modeling attributing and documenting intelligence gathered during investigations. Serve as the primary owner for attribution efforts while partnering with incident response teams responsible for forensics and customer engagement.
• Enable Microsoft Security teams by delivering actionable intelligence and attribution insights that support the detection investigation and remediation of advanced threats across Microsofts security ecosystem.
• Drive product and service improvements by translating intelligence on adversary activity exploitation techniques and emerging attack trends into recommendations that strengthen the security of Microsofts products and services.
• Identify and track emerging threats by discovering previously untracked adversary activity developing new threat clusters into tracked actor groups and conducting deep analysis across the Diamond Model and multiple Microsoft telemetry sources to advance Microsofts understanding of the threat landscape.
• Communicate intelligence to diverse audiences through written reports executive briefings and customer-facing presentations. Support customer notifications related to imminent ongoing or impactful threat activity.
• Strengthen the intelligence feedback loop by ensuring insights gained during investigations including novel capabilities infrastructure targeting patterns and tradecraft are rapidly shared with Microsoft Threat Intelligence Center (MSTIC) tracking teams to improve detection attribution and future investigations.

Required/Minimum Qualifications

• Bachelors Degree in Statistics Mathematics Computer Science Computer Security or related field AND 4 years experience in software development lifecycle large-scale computing threat analysis or modeling cybersecurity vulnerability research and/or anomaly detection
  • OR Masters Degree in Statistics Mathematics Computer Science Computer Security or related field AND 3 years experience in software development lifecycle large-scale computing threat analysis or modeling cybersecurity vulnerability research and/or anomaly detection
  • OR Doctorate in Statistics Mathematics Computer Science Computer Security or related field
  • OR equivalent experience.

Other Requirements:

Security Clearance Requirements: Candidates must be able to meet Microsoft customer and/or
government security screening requirements as required for this role. These requirements include but
are not limited to the following specialized security screenings:

• The successful candidate must have an active U.S. Government Secret Security Clearance. Ability
  to meet Microsoft customer and/or government security screening requirements are required for
  this role. Failure to maintain or obtain the appropriate clearance and/or customer screening
  requirements may result in employment action up to and including termination.
• Clearance Verification: This position requires successful verification of the stated security
  clearance to meet federal government customer requirements. You will be asked to provide
  clearance verification information prior to an offer of employment.
• Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud
  background check upon hire/transfer and every two years thereafter.
• Citizenship & Citizenship Verification: This position requires verification of U.S. citizenship due
  to citizenship-based legal restrictions. Specifically this position supports United States federal
  state and/or local United States government agency customer and is subject to certain
  citizenship-based restrictions where required or permitted by applicable law. To meet this legal
  requirement citizenship will be verified via a valid passport or other approved documents or
  verified US government Clearance

Preferred qualifications

• Bachelors Degree in Statistics Mathematics Computer Science Computer Security or related field AND 8 years experience in software development lifecycle large-scale computing threat analysis or modeling cybersecurity vulnerability research and/or anomaly detection
  • OR Masters Degree in Statistics Mathematics Computer Science Computer Security or related field AND 6 years experience in software development lifecycle large-scale computing threat analysis or modeling cybersecurity vulnerability research and/or anomaly detection
  • OR Doctorate in Statistics Mathematics Computer Science Computer Security or related field AND 3 years experience in software development lifecycle large-scale computing threat analysis or modeling cybersecurity vulnerability research and/or anomaly detection
  • OR equivalent experience

• Background in cloud and identity-based intrusions token theft OAuth abuse SaaS-native tradecraft
• Detection engineering or hunting query development at scale
• Use of automation data science or AI tooling to accelerate triage clustering and analysis
• Experience delivering customer or executive briefings under time pressure during active incidents
• Working knowledge of malware used in targeted campaigns including triage of malicious capabilities.
• Familiarity with Microsoft security data sources - MDC Defender XDR Sentinel Azure Resource Graph.
• Strong technical knowledge of adversary capabilities infrastructure and techniques and the ability to develop new methods to discover and track them.
• Experience tracking advanced financially motivated or state-sponsored adversaries using the Diamond Model; ability to characterize TTPs infrastructure and operational campaigns.
• Demonstrated experience producing actionable intelligence that changed the outcome of an investigation or hardened a defended network.
• Familiarity with host log and network forensics common protocols and a range of adversary command-and-control methods.
• Demonstrated experience with log analysis and query languages (KQL/Kusto SQL or equivalent) across SIEM identity endpoint or cloud telemetry.
• Experience with large-scale cloud identity and endpoint telemetry.
• Experience supporting incident response and familiarity with common IR procedures and tooling.
• Ability to communicate findings clearly with appropriate confidence language to technical and executive audiences.

Security Research IC4 - The typical base pay range for this role across the U.S. is USD $119800 - $234700 per year. There is a different range applicable to specific work locations within the San Francisco Bay area and New York City metropolitan area and the base pay range for this role in those locations is USD $160200 - $261000 per year.

Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
position will be open for a minimum of 5 days with applications accepted on an ongoing basis until the position is filled.

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age ancestry citizenship color family or medical care leave gender identity or expression genetic information immigration status marital status medical condition national origin physical or mental disability political affiliation protected veteran or military status race ethnicity religion sex (including pregnancy) sexual orientation or any other characteristic protected by applicable local laws regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process read more about requesting accommodations.

Required Experience:

IC