Senior Security Researcher

The Cloud & AI organization accelerates Microsoft’s mission and bold ambitions to ensure that our company and industry is securing digital technology platforms, devices, and clouds in our customers’ heterogeneous environments, as well as ensuring the security of our own internal estate. Our culture is centered on embracing a growth mindset, a theme of inspiring excellence, and encouraging teams and leaders to bring their best each day. In doing so, we create life-changing innovations that impact billions of lives around the world. Microsoft is one of the largest enterprise service companies in the world.

Do you have a passion for helping Microsoft’s clients defend themselves against targeted exploitation? Are you interested in being intimately involved in the latest, cutting-edge developments in the security industry and having a direct impact on the security of all Microsoft customers? Do you want to be on the front lines of helping our customers go toe-to-toe against advanced adversaries? Are you interested in a fast-paced job full of new opportunities? Consider applying for the Senior Security Researcher position within the Applied Intelligence team.

As an Applied Intelligence Analyst, you will apply Microsoft Threat Intelligence Center (MSTIC)’s threat intelligence to live investigations across Microsoft's products, services, and customer estates. You sit where intelligence meets incident response: enriching investigations with threat actor context, driving attribution, producing actionable intelligence, discovering and building out emerging clusters of adversary activity, and feeding what you learn back into Microsoft's threat actor tracking mission. In this role, you will collaborate with internal teams (GHOST, DART, etc.) across incident response, threat intelligence, and product groups to protect both Microsoft and Microsoft’s customers. You will strengthen existing partnerships and build new ones with key organizations to deliver benefits to Microsoft and its customers.

• Investigation support. Providing threat intelligence support to proactive security research and reactive incident response engagements across both internal and customer-facing investigations.
• Attribution and actor modeling. Ingesting, modeling, attributing, and documenting intelligence collected during engagements. Owning the attribution lane while investigation partners lead forensics and customer response.
• Supporting Partner Teams: Providing attribution analysis and intelligence support to Microsoft Security partner teams investigating and responding to threats.
• Product Improvements: Ensuring observations of threat actor exploitation of Microsoft products and services translate into product improvements.
• Emerging threats. Discovering untracked clusters of activity with novel capabilities, developing them into tracked threat groups through in-depth research across the Diamond Model and multiple Microsoft telemetry sources, and helping Microsoft stay on top of the latest and newest threats.
• Briefing and delivery. Delivering threat intelligence briefings to external customers and internal stakeholders. Supporting notifications to customers regarding imminent or ongoing attacker activity.
• Feedback loop. Ensuring intelligence collected during reactive investigations— novel capabilities, infrastructure, targeting, or tradecraft — is promptly collated and surfaced back to Microsoft's actor tracking teams in MSTIC.

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.