Principal Corporate Counsel

Microsoft•Washington, DC

2d•$132,200 - $248,600

About The Position

Microsoft’s Digital Crimes Unit (DCU) is seeking a motivated, technically fluent attorney to handle global investigations and drive high-impact projects disrupting sophisticated cybercriminal networks and other online threats, including ransomware, transnational fraud and scams, and malicious uses of AI. The role focuses on proactive civil litigation, legal and technical innovation, and external outreach to defend Microsoft, its customers, and democratic institutions against cyberattacks and related threats. The DCU is a global team of attorneys, investigators, and analysts that works with threat intelligence, fraud and abuse teams, and engineering partners to develop legal and technical strategies for detecting, disrupting, and deterring cybercrime and other cyber- and AI-enabled crime. The DCU is part of the Customer Security & Trust team within Microsoft Global Affairs and Corporate, External, and Legal Affairs. The attorney will independently manage complex litigation matters and collaborate with threat intelligence and security professionals, security engineers, and fraud and abuse analysts. The role requires working across stakeholders, navigating ambiguity and time constraints, and developing strategies and affirmative cases concerning evolving cyber threats. The attorney will also advise on government data requests and voluntary disclosures, engage with government officials, industry representatives, and customers, and brief executives and present publicly on complex, sensitive issues.

Requirements

Juris Doctor degree or international equivalent and at least 4 years of experience as a practicing attorney, or equivalent experience.
Active license to practice law in a jurisdiction and ability to meet admission requirements in the relevant jurisdiction.
Ability to meet Microsoft, customer, and/or government security screening requirements, including the Microsoft Cloud Background Check upon hire or transfer and every two years thereafter.

Nice To Haves

Juris Doctor degree or international equivalent and at least 5 years of experience as a practicing attorney, or equivalent experience.
At least 3 years of experience as an attorney in a specialized practice area such as litigation, investigations, or cybercrime.
At least 1 year of in-house counsel experience.
Experience engaging with government officials and law enforcement, including the Department of Justice, FBI, and foreign equivalents.
Experience handling complex investigations and litigation.
Familiarity with the Computer Fraud and Abuse Act (18 U.S.C. § 1030), Access Device Fraud (18 U.S.C. § 1029), Racketeer Influenced and Corrupt Organizations (18 U.S.C. § 1961), and Lanham Act (18 U.S.C. § 2320).
Experience developing, evaluating, and executing high-impact, time-sensitive strategic projects, and adapting to changing guidance and priorities.
Familiarity with the Electronic Communications Privacy Act and other laws and regulations governing disclosure of and access to electronically stored data.
Experience managing projects and partnering with cross-functional teams.
Written and verbal communication skills, including the ability to explain complex technical findings to law enforcement, legal counsel, executives, and other stakeholders.
Fluency in basic internet and DNS concepts, including data exchange between computers, domain-name mapping to IP addresses, and high-level domain-name and IP-address governance, allocation, and assignment.
Desire to learn, grow, and drive change.
Collaborative, team-first mindset.

Responsibilities

Work independently and on cross-discipline teams on projects relating to investigations, litigation, and enforcement actions.
Oversee the collection and production of accurate information for court filings, law enforcement referrals, and internal and external cybersecurity reporting.
Develop and implement legal and technical strategies to scale DCU operations, including the ongoing incorporation of AI.
Provide legal advice on government requests for data and voluntary disclosures of data.
Engage with government officials, industry representatives, and customers on cybersecurity and cybercrime issues.
Brief executives and deliver public presentations on complex and sensitive matters.