Senior Security Researcher - CTJ - Secret

Overview Security is one of the most critical priorities for customers navigating an increasingly complex landscape of digital threats, regulatory requirements, and rapidly evolving technology environments.

Microsoft Security is committed to making the world a safer place by empowering every user, customer, and developer with a comprehensive security cloud that delivers end-to-end protection through simplified, integrated solutions.

As part of Microsoft's Cloud & AI organization, we advance Microsoft's mission to secure digital technology platforms, devices, applications, and cloud environments for customers worldwide, while also protecting Microsoft's own global infrastructure. Our culture is built on a growth mindset, a commitment to excellence, and a belief that diverse perspectives drive innovation.

Together, we create technologies that positively impact billions of people around the world.

Do you have a passion for helping organizations defend themselves against sophisticated cyber threats? Are you energized by the opportunity to work at the forefront of the threat intelligence and security industry? Do you want to play a direct role in protecting Microsoft and its customers from advanced adversaries?

If so, consider joining the Applied Intelligence team as an Applied Intelligence Analyst.

As an Senior Security Researcher , you will apply the Microsoft Threat Intelligence Center's (MSTIC) intelligence to active investigations across Microsoft's products, services, and customer environments.

Operating at the intersection of threat intelligence and incident response, you will enrich investigations with threat actor context, drive attribution efforts, produce actionable intelligence, identify emerging adversary activity, and contribute to Microsoft's threat actor tracking mission.

In this role, you will collaborate closely with incident response, threat intelligence, and product teams across Microsoft, including organizations such as GHOST and DART, to help protect both Microsoft and its customers.

You will leverage intelligence-driven insights to support investigations, strengthen strategic partnerships, and build new relationships with key stakeholders to advance Microsoft's security objectives and deliver meaningful impact for customers worldwide.

At Microsoft, our mission—to empower every person and every organization on the planet to achieve more—guides how we partner with customers to deliver trusted, impactful solutions. With a growth mindset culture, we innovate responsibly and measure success by shared progress—people, teams, and customers. Join us to do meaningful work that changes the world and helps shape what’s next for everyone.

Responsibilities

• Support high-impact investigations by providing threat intelligence expertise to both proactive security research initiatives and reactive incident response engagements across Microsoft and customer environments.
• Lead attribution and threat actor analysis by collecting, modeling, attributing, and documenting intelligence gathered during investigations. Serve as the primary owner for attribution efforts while partnering with incident response teams responsible for forensics and customer engagement.
• Enable Microsoft Security teams by delivering actionable intelligence and attribution insights that support the detection, investigation, and remediation of advanced threats across Microsoft's security ecosystem.
• Drive product and service improvements by translating intelligence on adversary activity, exploitation techniques, and emerging attack trends into recommendations that strengthen the security of Microsoft's products and services.
• Identify and track emerging threats by discovering previously untracked adversary activity, developing new threat clusters into tracked actor groups, and conducting deep analysis across the Diamond Model and multiple Microsoft telemetry sources to advance Microsoft's understanding of the threat landscape.
• Communicate intelligence to diverse audiences through written reports, executive briefings, and customer-facing presentations. Support customer notifications related to imminent, ongoing, or impactful threat activity.
• Strengthen the intelligence feedback loop by ensuring insights gained during investigations, including novel capabilities, infrastructure, targeting patterns, and tradecraft, are rapidly shared with Microsoft Threat Intelligence Center (MSTIC) tracking teams to improve detection, attribution, and future investigations.

Qualifications

Required/Minimum Qualifications

• Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection,
• OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
• OR Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field
• OR equivalent experience.

Other Requirements

Security Clearance Requirements: Candidates must be able to meet Microsoft, customer and/or

government security screening requirements as required for this role. These requirements include, but

are not limited to the following specialized security screenings:

• The successful candidate must have an active U.S. Government Secret Security Clearance. Ability

to meet Microsoft, customer and/or government security screening requirements are required for

this role. Failure to maintain or obtain the appropriate clearance and/or customer screening

requirements may result in employment action up to and including termination.

• Clearance Verification: This position requires successful verification of the stated security

clearance to meet federal government customer requirements. You will be asked to provide

clearance verification information prior to an offer of employment.

• Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud

background check upon hire/transfer and every two years thereafter.

• Citizenship & Citizenship Verification: This position requires verification of U.S. citizenship due

to citizenship-based legal restrictions. Specifically, this position supports United States federal,

state, and/or local United States government agency customer and is subject to certain

citizenship-based restrictions where required or permitted by applicable law. To meet this legal

requirement, citizenship will be verified via a valid passport, or other approved documents, or

verified US government Clearance

Preferred qualifications

• Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 8+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
• OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 6+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
• OR Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
• OR equivalent experience
• Background in cloud and identity-based intrusions — token theft, OAuth abuse, SaaS-native tradecraft
• Detection engineering or hunting query development at scale
• Use of automation, data science, or AI tooling to accelerate triage, clustering, and analysis
• Experience delivering