Security Analyst II

Microsoft • Redmond, WA

12d • $102,100 - $219,200 • Hybrid

About The Position

The Cyber Defense Investigations team is Microsoft's deep-dive investigative arm within Cyber Defense Operations. It investigates complex security incidents across Microsoft's cloud, identity, and supply chain environments, conducts root cause analysis, assesses attacker activity, and drives remediation and detection improvements.

The Security Analyst II will lead investigations, create rapid detections, perform threat hunting, collaborate with engineering and response teams, and help improve Microsoft's ability to detect and respond to advanced threats. The role is part of the CDI Escalations team, investigating complex nation-state, supply chain, cloud, and identity-based attacks. The team combines investigations, threat hunting, intelligence operationalization, and cross-organizational collaboration to identify adversaries and improve security across Microsoft platforms. The analyst will partner with MSTIC, GHOST, Detection Engineering, and service teams, use AI-powered investigation techniques, and contribute to Microsoft's security posture.

Beginning February 2026, Microsoft employees are expected to work from a designated Microsoft office at least three days per week if they live within 50 miles in the U.S. or 25 miles outside the U.S. of that office, subject to local law and jurisdiction-specific variation.

Requirements

• Master's degree in Statistics, Mathematics, Computer Science, or a related field and at least 1 year of experience in software development lifecycle, large-scale computing, threat modeling, cybersecurity, anomaly detection, SOC detection, threat analytics, SIEM, IT, or operations incident response; or bachelor's degree in one of those fields and at least 2 years of such experience; or equivalent experience.
• Must be able to meet Microsoft, customer, and/or government security screening requirements, including passing the Microsoft Cloud Background Check upon hire or transfer and every two years thereafter.

Nice To Haves

• Experience with Sentinel or other detection authoring tools.
• Experience investigating security incidents in cloud or enterprise environments.
• Experience using KQL/Kusto, SQL, or similar query languages for log analysis.
• Understanding of attacker techniques, cloud security, identity security, and the MITRE ATT&CK framework.
• Strong analytical and communication skills.
• Experience with Microsoft security platforms, including Defender XDR, Sentinel, Entra ID, and Azure security telemetry.
• Experience investigating identity-based attacks, credential theft, OAuth abuse, or cloud compromise scenarios.
• Experience with supply chain security investigations involving GitHub, npm, or software package ecosystems.
• Familiarity with AI-assisted investigation workflows and security automation.
• Security certifications such as GCIH, GCFA, CISSP, GCFE, OSCP, or equivalent.

Responsibilities

• Investigate complex security incidents involving cloud, identity, endpoint, and supply chain compromises.
• Author detections rapidly.
• Conduct root cause analysis, impact assessment, and scope determination.
• Perform proactive threat hunting using Kusto (KQL), Defender, Entra ID, Azure, and other Microsoft telemetry sources.
• Partner with Detection Engineering, MSTIC, Service Teams, and Incident Response teams to contain and remediate threats.
• Develop investigative queries, hunting content, playbooks, and automation to improve operational efficiency.
• Translate investigation findings into actionable security improvements, detections, and process enhancements.
• Produce clear technical and executive-ready investigation reports.
• Mentor peers and contribute to investigative best practices and knowledge sharing.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level