Threat Context Analyst

The Customer Security & Trust (CST) team is looking for a threat context analyst to build our private sector offensive actor and cybercriminal portfolio. CST is a part of Microsoft’s Corporate, External, and Legal Affairs (CELA) and leads much of Microsoft’s work to ensure that our customers are protected from the actions of advanced and persistent adversaries. Partnering with the Microsoft Threat Intelligence Center (MSTIC) and the Digital Crimes Unit (DCU) the analyst will help provide deeper understanding and context to attacks driven by cybercriminal groups and private sector offensive actors – companies selling their offensive services to the highest bidder. Understanding the threats, motivations and the geopolitical consequences of these threats is an essential part of our approach to protecting our customers, the computing ecosystem, and Microsoft itself.

Role:
In this role, the analyst will work closely with MSTIC, DCU, and other cybersecurity organizations at Microsoft in the analysis of and reporting on activities related to cybercriminal groups and private sector offensive actors (PSOAs). This analyst will bring significant understanding of the geopolitical issues, motivations and interests of these groups and communities. This analyst will partner closely with MSTIC experts on cyber threats in this space and help us create reports and analysis for use internally and externally with executives, customers, and others in the security community.

Responsibilities

Key Responsibilities:
Analyze data/intelligence from cross company sources, the threat intelligence community, and open source information to build portfolios on cybercriminal groups and PSOAs.

Research, assess, and report on PSOA / cybercriminal affiliations, the market for PSOA / cybercriminal tools and services, capabilities, motivations and targeting.

Research, analyze, and compose reports, including threat estimates, related to the geopolitical, cyber security, national, and international impact of PSOA or cybercriminal activity.

Conduct “all source analysis” and compose written products to forecast tactical and strategic scenarios.

Support MSTIC or DCU responses to events or incidents involving any of the groups or actors tracked within the portfolio.

Collaborate with all security teams cross company providing regional expertise and analysis on projects and reports related to cybersecurity.

Qualifications

Required Qualifications:
5 years of experience in working in threat analysis or threat intelligence.

Deep collaboration experience with front-line actor analysts.

Strong experience and deep technical knowledge of criminal groups’ and/or Private Sector Offensive Actor capabilities, infrastructure, and techniques and political / geopolitical issues.

3+ years of experience producing actionable threat intelligence and written analysis, reports, and products.

US citizenship

Preferred Experience:
Russian language skills preferable.

Strong writing skills, including experience in taking complex technical concepts and making them consumable and relatable to broader groups of readers.

Proven ability to build strategic relationships with key threat intelligence partners in government and industry.

Ability to transform diverse data, context and information into intelligence products, reports, and analysis that can be consumed by both technical and non-technical audiences.

Delivers written material and presentations to internal and external audiences.

Ability to quickly and efficiently sort through data to identify key issues or variables to consider in making important strategic decisions.

Excellent cross-group collaborator with strong organizational skills, quickly understanding and meeting needs of customer and peer teams.

Ability to effectively multi-task and prioritize in a fast-paced environment.

Current or ability to receive/maintain a US top secret security clearance or higher.

Domestic and international travel will be required, estimated to be less than 30%. This includes quarterly meetings at Microsoft’s Corporate Headquarters, in Redmond, WA. The role is based in our Reston, VA office.

Citizenship Verification: This position requires verification of US Citizenship to meet federal government security requirements.

#CELA

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable laws, regulations and ordinances. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. If you need assistance and/or a reasonable accommodation due to a disability during the application or the recruiting process, please send a request via the Accommodation request form.

Benefits/perks listed below may vary depending on the nature of your employment with Microsoft and the country where you work.