below marketmost similar roles pay hereabove market
This role pays more than
57%
of similar roles. Most pay
$150,574–$197,775
— the blue band above.
At the midpoint, this role pays about
$177k
versus about
$174k
for comparable roles.
Based on 240 similar postings.
Employer
About Microsoft
Microsoft Corporation is a global technology leader producing software, hardware, and cloud services including Windows, Office 365, Azure cloud platform, Xbox gaming, and Surface devices. Industry: Software & Cloud Computing
Microsoft currently has
634 open roles
on FindRole.
Listed pay typically runs
$119,800–$234,700
across 612 roles with salary data.
JOB TITLE: Senior Security Researcher - CTJ - Secret
The Senior Applied Intelligence Researcher joins the Applied Intelligence team to support high-impact investigations across Microsoft products, services, and customer environments. This role operates at the intersection of threat intelligence and incident response, where the researcher will enrich investigations with threat actor context, lead attribution efforts, and produce actionable intelligence. Day-to-day responsibilities include identifying emerging adversary activity, modeling intelligence, and translating exploitation techniques into product security recommendations. The position requires expertise in threat analysis, vulnerability research, and anomaly detection. Key technical skills include proficiency with KQL, SQL, and Microsoft security data sources like Defender XDR and Sentinel. The researcher will utilize the Diamond Model to track state-sponsored or financially motivated adversaries, providing critical insights to strengthen the security of the global cloud and identity ecosystem.
Provide threat intelligence expertise to support proactive security research and reactive incident response engagements.
Lead attribution and threat actor analysis by collecting, modeling, and documenting intelligence gathered during investigations.
Deliver actionable intelligence and attribution insights to support the detection and remediation of advanced threats.
Translate intelligence on adversary activity and exploitation techniques into recommendations to strengthen product security.
Identify and track emerging threats by discovering new adversary activity and developing new threat clusters.
Communicate intelligence findings through written reports, executive briefings, and customer-facing presentations.
Share insights on novel capabilities and infrastructure with tracking teams to improve detection and future investigations.
What we're looking for
Must have a Bachelor's degree in a related field and 4+ years of relevant experience, a Master's and 3+ years, or a Doctorate.
Must have an active U.S. Government Secret Security Clearance.
Must be a U.S. citizen as required by legal restrictions for supporting government customers.
Must be able to pass a Microsoft Cloud background check every two years.
Experience in software development lifecycle, large-scale computing, threat analysis, cybersecurity, vulnerability research, or anomaly detection is required.
Background in cloud and identity-based intrusions, including token theft and OAuth abuse (preferred).
Experience with log analysis and query languages like KQL, Kusto, or SQL (preferred).
Experience tracking state-sponsored adversaries using the Diamond Model (preferred).
Vulnerability Research
Offensive Security
Exploit Development
Reverse Engineering
AI
Threat Analysis
Anomaly Detection
Software Development Lifecycle
Cybersecurity
Capture The Flag (CTF)
Vulnerability Research
Offensive Security
Exploit Development
Reverse Engineering
AI
Threat Analysis
Anomaly Detection
Software Development Lifecycle
Large-scale Computing
Capture The Flag (CTF)
Azure
AWS
GCP
Python
Go
C#
TypeScript
Terraform
Bicep
CloudFormation
Kubernetes
CI/CD
Active Directory
Entra ID
Okta
Linux
Windows
infrastructure-as-code
Identity Federation
Security Telemetry
AI Red Teaming
Adversarial Machine Learning
Generative AI
Penetration Testing
Python
C#
C/C++
PowerShell
Kali Linux
Burpsuite
Nmap
Nessus
Vulnerability Research
Anomaly Detection
Threat Analysis
Software Development Lifecycle
Statistics
Predictive Analytics
Azure Government
GCC High
DoD
SIEM
Incident Response
Threat Hunting
Digital Forensics
Identity Systems
M365
Telemetry
Anomaly Detection
Threat Modeling
CJIS
FedRAMP
SOC
Data Governance
Signal Correlation