Insider Risk Investigator

Microsoft

Confirmed live yesterday High trust

Remote

Quick summary

Work type: Remote
Location: Remote
Salary: $119,800–$234,700 / yr
Posted: 6 days ago
Freshness: Confirmed live yesterday
Closes: Apr 19, 2027

Market check

Salary context

Competitive pay

How this pay compares to similar roles

Similar $171k

This role $177k

$106k $248k

below market most similar roles pay here above market

This role pays more than 62% of similar roles. Most pay $141,714–$199,650 — the blue band above. At the midpoint, this role pays about $177k versus about $171k for comparable roles.

Based on 240 similar postings.

Employer

About Microsoft

Microsoft Corporation is a global technology leader producing software, hardware, and cloud services including Windows, Office 365, Azure cloud platform, Xbox gaming, and Surface devices. Industry: Software & Cloud Computing

Microsoft currently has 694 open roles on FindRole.

Listed pay typically runs $119,800–$234,700 across 651 roles with salary data.

Most-posted roles

View all roles at Microsoft

At a glance

TL;DR · Insider Risk Investigator

Role Posting Log in to save

JOB TITLE: Insider Risk Investigator - CTJ - Top Secret The Senior Investigator leads complex insider risk investigations across on-premises, cloud, and endpoint systems to identify and contain risks to people, data, and intellectual property. This role involves executing the end-to-end investigative cycle, including evidence development, technical analysis, and documentation of findings. You will partner with technical subject matter experts to interpret data sources, develop detection logic, and refine investigative triggers. Key responsibilities include coordinating with legal, HR, security, and compliance partners to ensure evidentiary integrity and governance compliance. The role requires proficiency in programming and query languages such as Python, Powershell, SQL, and KQL, alongside experience in Azure cloud environments. You will solve technical problems related to threat modeling, anomaly detection, SIEM, and root cause analysis within a high-security framework.

Skills

Python PowerShell SQL KQL Azure SIEM SOC DevSecOps Threat Modeling Anomaly Detection Incident Response Identity and Access Management Penetration Testing Root Cause Analysis Software Development Lifecycle

What you'll do

Execute the end-to-end investigative cycle including evidence development, technical analysis, and documentation of findings.
Ensure all investigative work products maintain evidentiary integrity and comply with established program standards.
Translate complex technical investigative activities into clear, structured findings and insights for stakeholders.
Identify and interpret relevant data sources from on-premises, cloud, and endpoint systems.
Develop and refine detection logic, investigative triggers, and signal quality to improve outcomes.
Perform root cause analysis and provide evidence-based conclusions for complex insider risk investigations.
Coordinate with legal, HR, and security partners to support cross-functional investigations and minimize effort duplication.
Develop new detection plans and playbooks to evolve insider risk response capabilities.

What we're looking for

Must have a Doctorate in a related field or a Master's with 3+ years of relevant experience or a Bachelor's with 4+ years of relevant experience.
Must have equivalent experience to the specified degree and years of experience requirements.
Must be a U.S. citizen.
Must possess an active U.S. Government Top Secret Security Clearance.
Must be able to pass a Microsoft Cloud background check.
Proficiency in programming and query languages such as Python, Powershell, SQL, and KQL (preferred).
Proficiency in Azure cloud environments with a strong understanding of data flows and access management (preferred).
Master's Degree in Statistics, Mathematics, Computer Science, or related field AND 3+ years.

Similar roles

Senior Security Researcher

Microsoft

22 days ago $119,800–$234,700

Threat Intelligence Incident Response KQL Kusto SQL Sentinel Defender XDR Azure Resource Graph MDC Cybersecurity Vulnerability Research Anomaly Detection Data Science AI Network Forensics Log Analysis SIEM OAuth Diamond Model

4+ yrs exp Hybrid

Save

Senior Insider Threat Investigator

Allstate

Remote (IL) 4 days ago $80,000–$165,000

Digital Forensics SIEM DFIR NIST Cybersecurity Framework ISO 27001 GDPR Risk Analytics Insider Threat Mitigation Penetration Testing Root-Cause Analysis Cybersecurity Investigations Behavioral Monitoring Threat Assessment

3+ yrs exp Remote

Save

Senior Insider Threat Engineer

Humana

Remote (Louisville, KY) +9 20 days ago $97,900–$133,500

Microsoft Purview Proofpoint Insider Threat Management KQL PowerShell Microsoft Graph API Splunk Defender XDR UEBA EDR SIEM Data Loss Prevention eDiscovery Claude Code HIPAA HITRUST PCI-DSS SOC2

5+ yrs exp Remote

Save

Security Analyst II

Microsoft

21 days ago $102,100–$202,200

KQL Kusto Defender XDR Sentinel Azure Entra ID SQL SIEM MITRE ATT&CK Threat Hunting Root Cause Analysis Security Automation GitHub npm Software Development Lifecycle Anomaly Detection

2+ yrs exp Hybrid

Save

Senior Detection Portfolio Engineer

Microsoft

Remote 28 days ago $119,800–$234,700

Kusto KQL Python SIEM MITRE ATT&CK Threat Modeling Anomaly Detection LLM-based workflows Jupyter Synapse SOC Incident Response Automation Data Lakes Software Development Lifecycle Threat Analytics

4+ yrs exp Remote

Save

Principal Security Operations Engineer

Microsoft

Redmond, WA 34 days ago $142,800–$274,800

Microsoft Sentinel KQL SIEM Incident Response Threat Modeling Anomaly Detection SOC AI LLM Post-Quantum Cryptography Purview DTEX Proofpoint ITM Magnet Axiom Forcepoint Software Development Lifecycle Cybersecurity Threat Analytics

6+ yrs exp Hybrid

Save