Drimva

Microsoft

Government Cloud Investigations Analyst - CTJ - Secret

$120K–$261K

Redmond, WA +1 · On-site · Full-time · Posted Oct 27, 2026

Location
Redmond, WA
Reno, NV
Experience
3+ years with a relevant master's degree, or 4+ years with a relevant bachelor's degree, in the listed qualifying areas; no years specified for doctorate or equivalent experience.
Education
Doctorate in Statistics, Mathematics, Computer Science, or related field; OR Master's Degree in those fields and 3+ years qualifying experience; OR Bachelor's Degree in those fields and 4+ years qualifying experience; OR equivalent experience.

About the job

Investigates fraud, abuse, and security incidents in U.S. Government cloud environments, coordinating containment and producing audit-ready findings.

What you'll do

  • Investigate fraud, account compromise, insider risk, and misuse by correlating identity, billing, and telemetry signals.
  • Own or support high-severity incidents, coordinate containment and escalations, and document cases through closure.
  • Conduct threat hunting and improve investigation procedures, detection, and operational processes.

What they ask for

  • Doctorate in Statistics, Mathematics, Computer Science, or a related field; OR a relevant master's degree and 3+ years of qualifying experience; OR a relevant bachelor's degree and 4+ years of qualifying experience; OR equivalent experience.
  • Active U.S. Government Secret Security Clearance.
  • Pass the Microsoft Cloud background check and CJIS background check.
  • U.S. citizenship verification is required.

Nice to have

  • Experience supporting Azure Government, GCC High, or DoD environments.
  • Knowledge of CJIS Security Policy and government incident response procedures; background in threat hunting, digital forensics, or advanced incident response.

Pay

USD $119,800 - $234,700 per year (base salary); USD $160,200 - $261,000 per year (base salary)

Tools

Azure Government, GCC, GCC High, DoD, CJIS, FedRAMP, DoD SRG, M365

Model-written summary · the original posting is authoritative

First seen Oct 28, 2026 · Last verified Nov 5, 2026 (UTC)