Security Research - MSTIC Threat Intelligence

Описание

The Microsoft Threat Intelligence Center (MSTIC) is recruiting experienced nation-state threat hunters with highly honed threat intelligence analysis skills to provide unique insight on threats to protect Microsoft and its customers by delivering timely threat intelligence across product and services teams.

As a Threat Intelligence Analyst in MSTIC, you will track and analyze sophisticated threat actors (including nation-state and advanced persistent threats) and translate intelligence into actionable outcomes that improve Microsoft security products, services, and defenses.

Responsibilities

• Track sophisticated adversaries and use your technical knowledge of adversary capabilities, infrastructure, and techniques
• Define, develop, and implement techniques to discover and track current adversaries and identify the attacks of tomorrow
• Produce actionable intelligence, proactively drive hunting and detection capabilities, and contribute to the disruption of adversary activity to protect Microsoft and its customers
• Collaborate closely with MSTIC and partner with security, engineering, and product teams across Microsoft to protect Microsoft assets, products, and customer environments
• Strengthen existing partnerships and build new ones with key organizations to enhance collective defense and improve product and service security

Requirements

• At least 3+ years producing actionable threat intelligence on targeted and advanced persistent threats, with demonstrable impact on network and host defenses
• Proven expertise tracking and investigating APT adversaries, across all stages of the attach chain
• Strong ability to analyze and hunt adversary behavior end-to-end, map attack chains, and communicate clear, evidence-based intelligence to technical and executive audiences
• Ability to quickly adapt to a rapidly evolving telemetry landscape

Nice to have

• Experience operationalizing threat intelligence and hunting methodologies at scale, leveraging AI and automation, Python, or scalable analytical workflows
• Analysis of sophisticated malware and targeted attacks against enterprise or government environments, including identification of large-scale and supply chain attack patterns
• Cloud intrusion analysis in adversary operations
• Host forensic investigation and log analysis of advanced targeted adversaries
• Proven track record in producing actionable Threat Intelligence on APTs based on telemetry analysis

We offer

• Work site: 0 days / week in-office – remote
• Travel: Less than 25%
• Employment type: Full-Time