Insider Risk Investigator - CTJ - Top Secret

Microsoft•,

20d•$119,800 - $261,000

About The Position

The Insider Risk Investigator leads complex insider risk investigations across on-premises, cloud, and endpoint systems. The role applies analytical, forensic, and detection engineering techniques to identify, assess, and contain insider-driven risks to Microsoft’s people, data, and intellectual property. The investigator partners with Microsoft business units and cross-functional teams to coordinate response actions, communicate case information, and maintain evidence integrity and governance compliance throughout the investigative lifecycle. The role also contributes to improving insider risk detection and response capabilities by developing detection plans and playbooks. The position involves conducting end-to-end investigations, analyzing technical evidence, and producing clear, defensible findings. It collaborates with technical subject matter experts to access and interpret data sources and refine detection logic, triggers, and signal quality. Investigations are coordinated with investigators, legal, HR, security, and compliance partners while following established processes and avoiding duplicated effort. Candidates must have an active U.S. Government Top Secret Security Clearance, satisfy applicable Microsoft, customer, and government screening requirements, pass the Microsoft Cloud Background Check upon hire or transfer and every two years thereafter, and verify U.S. citizenship. The position is classified as Security Operations Engineering IC4. The typical U.S. base pay range is $119,800–$234,700 per year, with a range of $160,200–$261,000 per year for specified San Francisco Bay Area and New York City metropolitan locations. The position will be open for at least five days, with applications accepted until filled.

Requirements

Doctorate in Statistics, Mathematics, Computer Science, or a related field; or a master's degree in one of these fields and at least 3 years of relevant experience; or a bachelor's degree in one of these fields and at least 4 years of relevant experience; or equivalent experience.
Relevant experience may include software development lifecycle, large-scale computing, threat modeling, cybersecurity, anomaly detection, SOC detection, threat analytics, SIEM, IT, or operations incident response.
Must have an active U.S. Government Top Secret Security Clearance.
Must meet applicable Microsoft, customer, and/or government security screening requirements and maintain the appropriate clearance and screening status.
Must successfully verify the stated security clearance before an employment offer.
Must pass the Microsoft Cloud background check upon hire or transfer and every two years thereafter.
Must verify U.S. citizenship due to citizenship-based legal restrictions.

Nice To Haves

Bachelor's degree and at least 5 years of experience in software development lifecycle, large-scale computing, modeling, cybersecurity, anomaly detection, SOC detection, threat analytics, SIEM, IT, or operations incident response, or equivalent experience.
Proficiency in programming and query languages such as Python, PowerShell, SQL, and KQL.
Proficiency in Azure cloud environments and a strong understanding of data flows and access management.
Experience in threat detection, incident response, and root-cause analysis in cloud environments.
Experience in Identity and Access Management, Red Team, penetration testing, software development, DevSecOps, or another specialization.
Experience working with HR, legal, and compliance teams to align with company policies and regulations.
Experience supporting insider risk, trust and safety, security, or enterprise risk investigation programs.
Experience working with technical data sources and translating findings into actionable insights.
Familiarity with investigative standards, evidentiary principles, and structured investigative methodologies.
Ability to work effectively in ambiguous, cross-functional environments spanning technical and non-technical stakeholders.

Responsibilities

Execute the end-to-end investigative cycle, including evidence development, technical analysis, and documentation of findings using established investigative standards.
Ensure investigative work products are complete, defensible, and consistent with expectations for rigor, evidentiary integrity, and due process.
Translate technical investigative activity into clear, structured findings and insights for stakeholders.
Partner with technical subject matter experts to identify, access, and interpret data sources for investigative use.
Contribute to the development and refinement of detection logic, investigative triggers, and signal quality.
Apply technical expertise to support root-cause analysis and evidence-based conclusions across complex investigations.
Collaborate with investigators, legal, HR, security, and compliance partners to support coordinated, cross-functional investigations.
Ensure alignment with established processes and minimize duplication of investigative effort across teams.
Contribute to a culture of investigative rigor, accountability, and professional excellence.
Embody the company's culture and values.