Cyber Security Analyst

Microsoft • ,

4d • $102,100 - $219,200

About The Position

The Cyber Security Analyst works within Microsoft’s CDI Investigations team, a 24/7 security investigations function responsible for identifying, analyzing, and mitigating threats across Microsoft’s ecosystem. The analyst proactively detects, investigates, and responds to sophisticated security threats using security tooling, automation, and threat intelligence. The role includes analyzing alerts, correlating signals across systems, determining incident scope and root cause, and driving containment and remediation. It also contributes to improved detection logic and investigation workflows, and partners with cross-functional teams to strengthen security at scale.

The position operates in a fast-paced, high-impact environment and calls for analytical thinking and curiosity. The team emphasizes collaboration, trust, knowledge sharing, continuous improvement, and learning. The role is classified as Security Operations Engineering IC3. Candidates must meet applicable Microsoft, customer, and/or government security screening requirements, including a Microsoft Cloud Background Check upon hire or transfer and every two years thereafter.

Requirements

• Master’s degree in Statistics, Mathematics, Computer Science, or a related field and at least 1 year of experience in software development lifecycle, large-scale computing, threat modeling, cybersecurity, anomaly detection, SOC detection, threat analytics, SIEM, IT, or operations incident response; or a bachelor’s degree in one of those fields and at least 2 years of such experience; or equivalent experience.
• Must be able to meet Microsoft, customer, and/or government security screening requirements, including the Microsoft Cloud Background Check upon hire or transfer and every two years thereafter.

Nice To Haves

• Bachelor’s degree in Computer Science, Engineering, or a related field, or equivalent practical experience.
• At least 3 years of experience in Security Operations (SOC), threat detection and analysis, and/or Incident Response (IR).
• Hands-on experience investigating security alerts, analyzing incidents, and driving response actions.
• Experience with a programming or scripting language such as Python, C#, or JavaScript for automation or data analysis.
• Understanding of Windows, Linux, and macOS operating systems and system-level behavior relevant to security investigations.
• Foundational knowledge of threat actors, attack techniques, vulnerabilities, and malware.
• Strong analytical, problem-solving, and communication skills, including communicating findings to technical and non-technical stakeholders.
• Ability to manage multiple priorities in a fast-paced, high-volume operational environment.
• Ability to collaborate effectively with cross-functional and diverse teams.
• Industry certifications such as CISSP, CISM, CEH, GCIA, GCIH, GCFA, OSCP, or Security+.
• Experience using AI/ML-driven security capabilities, such as anomaly detection, behavioral analytics, or Copilot-like tools, to improve detection, investigation, or response.
• Experience analyzing host and network telemetry, including endpoint, identity, cloud, and network logs.
• Familiarity with threat analysis frameworks such as MITRE ATT&CK, Cyber Kill Chain, or Diamond Model.
• Experience with large-scale data analysis and correlation across datasets, such as Azure Data Explorer, Data Lake, or Cosmos DB.
• Experience with cloud security concepts and Azure technologies such as Functions, Logic Apps, or Storage.
• Proficiency in automation and analysis using Python, PowerShell, or Jupyter Notebooks, including working with APIs.
• Knowledge of KQL or similar query languages for security telemetry analysis.
• Understanding of networking fundamentals, including LAN/WAN and protocols, and modern threat landscape trends.
• Exposure to digital forensics, malware analysis, reverse engineering, or penetration testing.

Responsibilities

• Proactively identify and respond to sophisticated threats by analyzing security signals, driving containment, and reducing risk to critical systems and data.
• Conduct end-to-end investigations of complex security events, determine scope and root cause, document findings, and drive incidents to resolution.
• Partner with threat intelligence, detection engineering, product teams, and researchers to turn insights into improvements in detection, response, and remediation.
• Identify gaps in detections and workflows and contribute to building, tuning, and scaling automation and detection logic.
• Use data, analytics, and security telemetry to prioritize work and improve investigation quality and consistency across global operations.
• Apply new techniques, tools, and intelligence to strengthen investigations and response against emerging threats.
• Support team development through mentorship, documentation, and sharing best practices.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level