Microsoft
Insider Risk Investigator - CTJ - Top Secret
$120K–$261K
United States · On-site · Full-time · Posted Oct 21, 2026
- Experience
- 3+ years with a master's degree or 4+ years with a bachelor's degree in specified relevant areas; doctorate or equivalent experience is also listed as an alternative. Preferred: bachelor's degree and 5+ years, or equivalent experience.
- Education
- Doctorate in Statistics, Mathematics, Computer Science, or related field; OR Master's Degree in those fields AND 3+ years relevant experience; OR Bachelor's Degree in those fields AND 4+ years relevant experience; OR equivalent experience.
- Visa sponsorship
- Requires active U.S. Government Top Secret Security Clearance and verification of U.S. citizenship; no visa policy stated.
About the job
Leads complex insider-risk investigations across on-premises, cloud, and endpoint systems, analyzes evidence, and helps improve detection and response capabilities.
What you'll do
- Conduct investigations, analyze evidence, and document defensible findings while maintaining evidentiary integrity.
- Work with technical experts to interpret data and refine detection logic, triggers, and signal quality.
- Coordinate investigations with legal, HR, security, and compliance partners.
What they ask for
- Doctorate in Statistics, Mathematics, Computer Science, or a related field; or a master's degree in one of these fields plus 3+ years of relevant experience; or a bachelor's degree in one of these fields plus 4+ years of relevant experience; or equivalent experience.
- Active U.S. Government Top Secret Security Clearance.
- Pass the Microsoft Cloud background check and verify U.S. citizenship.
Nice to have
- Proficiency in programming and query languages such as Python, Powershell, SQL, or KQL.
- Experience with Azure cloud environments, insider-risk investigations, threat detection, or incident response.
Pay
USD $119,800 - $234,700 per year (base salary); USD $160,200 - $261,000 per year (base salary)
Tools
Python, Powershell, SQL, KQL, Azure, SIEM
Model-written summary · the original posting is authoritative