Security Analyst II
Microsoft· Security Operations Engineering
Redmond, WA$102.1k - $202.2kFull-timePosted 2w ago
About the role
The Cyber Defense Investigations team investigates complex security incidents across Microsoft’s cloud, identity, and supply chain environments, conducts root cause analysis, assesses attacker activity, and drives remediation and detection improvements. The role leads investigations, crafts detections, performs threat hunting, collaborates with engineering and response teams, and helps improve Microsoft’s ability to detect and respond to advanced threats within CDI Escalations.
Responsibilities
- Investigate complex security incidents involving cloud, identity, endpoint, and supply chain compromises.
- Ability to author detection at rapid speed.
- Conduct root cause analysis, impact assessment, and scope determination.
- Perform proactive threat hunting using Kusto (KQL), Defender, Entra ID, Azure, and other Microsoft telemetry sources.
- Partner with Detection Engineering, MSTIC, Service Teams, and Incident Response teams to contain and remediate threats.
- Develop investigative queries, hunting content, playbooks, and automation to improve operational efficiency.
- Translate investigation findings into actionable security improvements, detections, and process enhancements.
- Produce clear technical and executive-ready investigation reports.
- Mentor peers and contribute to investigative best practices and knowledge sharing.
Qualifications
- Master’s Degree in Statistics, Mathematics, Computer Science, or related field AND 1+ year(s) experience in software development lifecycle, large-scale computing, threat modeling, cyber security, anomaly detection, SOC detection, threat analytics, SIEM, IT, or operations incident response OR Bachelor’s Degree in Statistics, Mathematics, Computer Science, or related field AND 2+ years experience in software development lifecycle, large-scale computing, threat modeling, cyber security, anomaly detection, SOC detection, threat analytics, SIEM, IT, or operations incident response OR equivalent experience.
Skills
Required:Threat huntingDetection engineeringKusto (KQL)
Nice to have:Microsoft security platforms
Benefits
- Certain roles may be eligible for benefits and other compensation. See pay information link.
Last updated Oct 9, 2026. Interested? Apply on the company site.
About Microsoft
Cloud ComputingConsumer ElectronicsSoftwareTechnologyliquid-ai-recruiting-target
More open roles at Microsoft
- Senior Security Sales Specialist4d agoHybrid (Auckland) · Digital Solution Area Specialists
- Technical Program Manager4d agoRedmond, WA, Multiple Locations · Technical Program Management
- AI Business Solutions Specialist Manager - M365 Copilot / Agents / Dynamics 365 / Power Platform4d agoTokyo · Solution Area Specialists
- Senior Technical Program Manager4d agoRedmond, WA, Hybrid (Multiple Locations) · Technical Program Management
- Senior Subsea Project & Operations Manager4d agoTokyo, Japan · Sourcing Engineering