Senior Security Researcher - Threat Desk Analyst - GHOST

Do you want to join the Microsoft GHOST team as a Senior Security Researcher?
Do you have an interest in helping Microsoft’s clients defend themselves against targeted exploitation? Are you interested in being intimately involved in the latest, cutting-edge developments in the security industry and having a direct impact on the security of all Microsoft customers? Do you want to be on the front lines of helping our customers go toe-to-toe against advanced adversaries? Are you interested in a fast-paced job full of new opportunities? If so, you might be a candidate for the Global Hunting, Oversight, and Strategic Triage team (GHOST).

We are looking for an experienced Senior Security Researcher with required analytical background to join our team to assist with investigations, develop threat intelligence, and to cultivate investigation best practices into Microsoft tooling and products. Researchers will support a global team to identify and catalog new attacker Tools, Techniques and Procedures (TTPs), victims, and deliver customer notifications to protect worldwide enterprise customers and empower customers to protect themselves via constantly improving Microsoft products.

As a Senior Security Researcher, you will be responsible for synthesizing analysis on adversary capabilities, techniques, and targeting from multiple data sources into customer-ready content to support incident response investigations and proactive engagements. They will act as a trusted advisor to investigators and customers identifying and communicating threats effectively to drive clarity. You will work closely with other internal stakeholders to ensure quality analysis.

Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

Responsibilities

This role is part of a collaborative team, assisting our customers with:

Identifying potential threats, allowing for proactive defence before an actual incident
Translating intelligence requirements into custom intelligence content.
Notifying customers regarding imminent attacker activity
Providing recommendations to improve customers’ cybersecurity posture going forward and performing threat intelligence knowledge transfer to prepare customers to defend against today’s threat landscape
Identifies, prioritizes, and targets complex security issues that cause negative impact to customers. Creates and drives adoption of relevant mitigations and provide proactive guidance
Works with others to synthesize research findings into recommendations for mitigation of security issues. Shares across teams. Drives change within team based on research findings.
Creating reports and presentations incorporating threat actor detail, threat detection and hunting guidance, and remediation recommendations.
Qualifications
6-12 years of experience producing tactical and strategic finished threat intelligence deliverables for customers including written content and presentations on threat actors, campaigns, and tactics, techniques, and procedures
Technical aptitude to translate technical analysis into polished deliverables independently
Expert at creating and presenting threat intelligence tailored for a variety of audiences including analysts, responders, and senior executives.
6+ years of experience supporting analysis and content delivery related to incident response and investigations.
Proven track record of collaborating across teams with threat hunters, analysts, incident responders, and customer representatives
Experience creating and presenting polished technical deliverables in a fast-paced environment.
Extensive knowledge of adversary groups, Diamond Model, and MITRE ATT&CK techniques
Familiarity and understanding of SQL or Kusto Query Language (KQL) queries (or experience with large database/SIEM query languages such as Splunk/Humio/Kibana, etc.)

Other Requirements:

Candidates must be able to meet Microsoft, customer and/or government security screening requirements are required for this role.

Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud background check upon hire/transfer and every two years thereafter.
Government Security Clearance

Preferred Qualifications:

Experience investigating APT groups including familiarity with Indicators of Compromise (IOCs), Indicators of Activity (IOAs) and attack Tools, Techniques and Procedures (TTPs)
Expertise in providing dedicated actionable intelligence support to customers
Excellent oral and written communication skills (Hebrew & English)
Proven knowledge of security fundamentals across Microsoft platforms (Client, Server, Cloud)
Knowledge of forensic and incident response processes and terminology
Consulting background
Understanding of technology and security principles and possess knowledge of the cyber threat landscape
Experience with Microsoft Azure and/or Office 365 platforms
Knowledge of third-party cybersecurity solutions
A desire to learn and grow, as well as a desire to help others do so

If you are looking for a role that will allow you to use your knowledge and passion to strengthen the security posture of customers, you will have a bright future within our Microsoft’s Global Hunting Oversight and Strategic Triage team.

#GHOST #GHOSTemea #MSFTSecurity #MSECR #GHOSTildc

Microsoft is an equal opportunity employer. Consistent with applicable law, all qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.