This role pays more than
63%
of similar roles. Most pay
$135,250–$195,243
— the shaded band above.
At the midpoint, this role pays about
$177k
versus about
$165k
for comparable roles.
Based on 238 similar postings.
Employer
About Microsoft
Microsoft Corporation is a global technology leader producing software, hardware, and cloud services including Windows, Office 365, Azure cloud platform, Xbox gaming, and Surface devices. Industry: Software & Cloud Computing
Microsoft currently has
598 open roles
on FindRole.
Listed pay typically runs
$119,800–$234,700
across 586 roles with salary data.
As a Senior Security Analyst on the Cyber Defense Investigations – Escalations team, you will lead deep-dive investigations into complex, high-severity security incidents including nation-state, supply chain, and identity-based attacks. You will perform root cause analysis, blast radius assessment, and threat actor attribution to disrupt adversaries targeting cloud environments. Day-to-day responsibilities include proactively hunting across cloud and identity telemetry, operationalizing threat intelligence into queries and detection logic, and translating findings into durable platform fixes and playbooks. You will utilize Kusto/KQL, SQL, and AI-powered investigation techniques like Copilot to accelerate triage and evidence collection. The role requires expertise in the MITRE ATT&CK framework, log analysis across SIEM and endpoint telemetry, and experience with tools such as Sentinel and Defender XDR to solve sophisticated security challenges within a large-scale cloud infrastructure.
Lead deep-dive investigations into high-severity security incidents including root cause analysis and threat actor attribution.
Proactively hunt across cloud and identity telemetry to identify emerging threats and operationalize intelligence into detection logic.
Manage cross-team responses for nation-state, supply chain, and identity-based compromises to contain and remediate attacks at scale.
Translate investigation findings into durable improvements such as new detections, platform fixes, and updated playbooks.
Utilize AI and Copilot technologies to accelerate triage, evidence collection, and analysis of security data.
Establish and maintain high standards for investigation quality through peer reviews and documented technical requirements.
Mentor peers in advanced investigation techniques, threat actor tradecraft, and reverse engineering.
What we're looking for
A Doctorate and 3+ years of experience, a Master's and 3+ years of experience, or a Bachelor's and 4+ years of experience in relevant technical fields.
Equivalent experience to the specified degree and experience requirements is acceptable.
Must be able to pass the Microsoft Cloud background check.
Experience in cybersecurity, incident response, threat hunting, or security investigations (preferred).
3+ years of experience conducting security investigations in large-scale cloud or enterprise environments (preferred).
Demonstrated experience with log analysis and query languages like KQL/Kusto or SQL (preferred).
Knowledge of modern attacker tradecraft, MITRE ATT&CK framework, and common cloud/identity attack paths (preferred).
Master's Degree in Statistics, Mathematics, Computer Science, or related field AND 3+ years.
AI
Cybersecurity
Threat Analysis
Vulnerability Research
Anomaly Detection
Software Development Lifecycle
Data Analysis
Security Telemetry
Automation
Observability
Large-scale Computing
Cyber Threat Intelligence
Microsoft Sentinel
Microsoft Defender XDR
MITRE ATT&CK
Python
PowerShell
C#
C++
AI
Large Language Models
Reverse-engineering
Cyber Kill Chain
Diamond Model
Network Protocols
Anomaly Detection
Vulnerability Research