> Markdown version of [/jobs/ext/1174208-principal-applied-threat-intelligence-analyst](https://www.wearedevelopers.com/jobs/ext/1174208-principal-applied-threat-intelligence-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Principal Applied Threat Intelligence Analyst... - **Company:** Microsoft - **Location:** Redmond, WA, United States - **Experience:** Experienced - **Salary:** $142,800.0 - $274,800.0 - **Contract:** Permanent contract - **Skills:** Microsoft Online Services, C Sharp (Programming Language), C++ (Programming Language), Cyber Security, Computer Programming, Python (Programming Language), Network Architecture, Network Protocols, Windows PowerShell, Reverse Engineering, Security Information and Event Management, Software Engineering, Scripting, Mitre Att&ck, Cyber Threat Analysis, Information Technology, Cybercrime, Microsoft Sentinel, Operating System Security, Vulnerability Analysis - **Published:** July 3, 2026 - **Apply:** https://www.juju.com/job/00000000gdbo3v ## About the Role + Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection. + OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection. + OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 6+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection. + OR equivalent experience. Other Requirements: Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings: Microsoft Cloud Background Check: + This position will be required to pass the Microsoft background and Microsoft Cloud background check upon hire/transfer and every two years thereafter. Preferred Qualifications: + Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 5+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection. + OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 8+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection. + OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 12+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection. + OR equivalent experience. + 10 + years of experience in cyber threat intelligence, threat hunting, incident response, or a closely related security discipline. + Demonstrated experience producing finished threat intelligence reporting for technical and/or executive audiences. + Attribution experience creating threat groups, assessing connections between established threat groups, and communicating attribution assessments to internal stakeholders and customers in a timely manner. + Working experience with Microsoft Sentinel and Microsoft Defender XDR (or directly comparable SIEM/XDR platforms). + Understanding of adversary tradecraft, the cyber kill chain, and frameworks such as MITRE ATT&CK, the Diamond Model, and structured analytic techniques. + Written and verbal communication skills, with a portfolio of public or customer-facing intelligence writing. + Experience with endpoint, cloud, network, and identity-based attacks and datasets. + Comprehensive OS security/internals knowledge. + Understanding of network protocols and analytical experience with network infrastructure data & telemetry. + Reverse-engineering with static and behavioral binary analysis experience. + Functional understanding of common threat analysis models such as the Diamond Model, Cyber Kill Chain, and MITRE ATT&CK. + Programming or scripting background (Python, PowerShell, C#, C++, etc.) \#MSSecurity ## Description As a Principal Applied Threat Intelligence Analyst, you will: + Author and publish high-impact threat intelligence reports (actor profiles, campaign analyses, trend reports, TTP deep-dives, vulnerability profiles) for both customer-facing and internal audiences. + Translate complex technical findings into clear, prescriptive guidance for security operations teams, executives, and the broader defender community. + Partner with product, research, marketing, and communications teams to land intelligence through Microsoft's customer-facing surfaces (Agentic Security, Defender XDR, Sentinel, blogs, briefings). + Build and refine the pipelines, tooling, and workflows that allow Microsoft to stream insightful cyber threat intelligence to customers machine speed. + Represent Microsoft Threat Intelligence in customer briefings, industry conferences, and cross-industry working groups. + Mentor analysts and contribute to tradecraft, analytic standards, and team-wide knowledge sharing. ## Related Videos - [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see) - [Intermediate Bitcoin Script](https://www.wearedevelopers.com/videos/25-intermediate-bitcoin-script) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) ## Related Articles - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 164: AI Agents, AI Blindspots and MCP security problems](https://www.wearedevelopers.com/magazine/578-dev-digest-164-ai-agents-ai-blindspots-and-mcp-security-problems) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)