below marketmost similar roles pay hereabove market
This role pays more than
85%
of similar roles. Most pay
$128,375–$185,125
— the blue band above.
At the midpoint, this role pays about
$209k
versus about
$157k
for comparable roles.
Based on 240 similar postings.
Employer
About Microsoft
Microsoft Corporation is a global technology leader producing software, hardware, and cloud services including Windows, Office 365, Azure cloud platform, Xbox gaming, and Surface devices. Industry: Software & Cloud Computing
Microsoft currently has
694 open roles
on FindRole.
Listed pay typically runs
$119,800–$234,700
across 651 roles with salary data.
The Principal Threat Intelligence Analyst joins the Microsoft Threat Intelligence Center to provide real-time visibility into hundreds of simultaneous intrusions. This role involves discovering and analyzing attacker activity across on-premises and cloud environments to convert data into finished intelligence and prioritized judgments. You will build proof-of-concept threat hunting tools, develop automations, and drive product improvements by conveying learnings from intrusion analysis to engineering teams. Key responsibilities include identifying potential threats for proactive defense, performing knowledge transfers, and using large-scale query workflows to distill adversary signals. Required skills include experience in the software development lifecycle, threat modeling, and vulnerability research. Candidates should possess proficiency in SQL or Kusto Query Language, knowledge of forensic log artifacts, and experience producing strategic, operational, and tactical threat intelligence for technical and executive audiences.
Discover and analyze attacker activity across on-premises and cloud environments.
Identify potential threats to enable proactive defense and customer notification before incidents occur.
Provide cybersecurity posture recommendations and threat intelligence knowledge transfers to customers.
Build proof-of-concept threat hunting tools, automations, and new security capabilities.
Convey threat intelligence and intrusion analysis findings to engineering teams to drive product improvements.
Use large-scale query workflows to distill adversary signals from high volumes of suspicious activity.
Produce strategic, operational, and tactical threat intelligence including actor tracking and campaign clustering.
What we're looking for
Must have a Doctorate and 3+ years of experience, a Master's and 4+ years, or a Bachelor's and 6+ years in a relevant technical field.
Must have experience in software development lifecycle, large-scale computing, threat analysis, cybersecurity, vulnerability research, or anomaly detection.
Must be a U.S. citizen.
Must possess an active U.S. Government Top Secret Security Clearance.
Must be able to pass the Microsoft Cloud background check.
Proven knowledge of security fundamentals across Microsoft platforms, especially identity, cloud control planes, and enterprise attack paths (preferred).
Experience producing strategic, operational, and tactical threat intelligence, including actor tracking and analytic writing (preferred).
Familiarity with SQL, Kusto Query Language (KQL), or similar SIEM query languages (preferred).
Cyber Threat Intelligence
AI
Large Language Models
Python
PowerShell
C#
C++
MITRE ATT&CK
Cyber Kill Chain
Diamond Model
Threat Hunting
Incident Response
Reverse-engineering
Network Protocols
Vulnerability Research
Anomaly Detection