Principal Threat Intelligence Analyst - CTJ - Top Secret

Microsoft•Reston, VA

About The Position

The Principal Threat Intelligence Analyst works on Microsoft’s Threat Intelligence Center (MSTIC), analyzing attacker activity across on-premises and cloud environments. The role uses real-time visibility into numerous simultaneous intrusions to produce finished intelligence, prioritized judgments, and protections at scale. The successful candidate discovers novel intrusions and adversary tradecraft and pursues improvements to product security and disruption opportunities. The position also involves supporting customers with proactive threat identification, notification, recommendations to improve cybersecurity posture, and threat intelligence knowledge transfer. The analyst builds threat-hunting tools and automations, uses large-scale query workflows to validate and scope suspicious activity, and conveys findings to engineering partners to drive product and tooling improvements.

Requirements

Doctorate in Computer Science, Cybersecurity, Intelligence Analysis, Mathematics, National Security Studies, or a related field and 3+ years of relevant experience; or a master’s degree in one of these fields and 4+ years of relevant experience; or a bachelor’s degree in one of these fields and 6+ years of relevant experience; or equivalent experience. Relevant experience includes software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
Must have an active U.S. Government Top Secret Security Clearance and be able to meet Microsoft, customer, and/or government security screening requirements.
Must pass the Microsoft Cloud background check upon hire or transfer and every two years thereafter.
Must verify U.S. citizenship because the position supports U.S. government customers and is subject to citizenship-based legal restrictions.
Demonstrated advanced problem-solving, troubleshooting, and analysis skills.

Nice To Haves

Knowledge of security fundamentals across Microsoft client, server, and cloud platforms, especially identity, cloud control planes, and enterprise attack paths.
Understanding of malware, tooling, and related activity sufficient to extract indicators and develop detections for attacker methods.
Reverse engineering or detection engineering experience.
Experience producing strategic, operational, and tactical threat intelligence, including actor tracking, campaign clustering, and analytic writing for technical and executive audiences.
Familiarity with SQL or Kusto Query Language (KQL), or large-database/SIEM query languages such as Splunk, Humio, or Kibana.
Deep knowledge of endpoint, email, and cloud forensic log artifacts, or similar experience analyzing SIEM, web server, antivirus, and security logs.
Experience building and reviewing threat-hunting automations using scripting languages.
Experience developing collection requirements, judging source reliability, and turning raw telemetry and partner reporting into actionable assessments.

Responsibilities

Discover and analyze attacker activity across on-premises and cloud environments.
Identify potential threats to enable proactive defense and customer notification before an incident occurs.
Provide recommendations to improve customers’ cybersecurity posture and transfer threat intelligence knowledge to help them defend against current threats.
Build proof-of-concept and prototype threat-hunting tools, automations, and capabilities.
Drive product and tooling improvements by sharing threat intelligence and intrusion-analysis findings with engineering partner teams.
Use large-scale query workflows to find, pivot on, validate, and scope relevant adversary signals within high volumes of suspicious activity.
Embody Microsoft’s culture and values.