This list contains only the countries for which job offers have been published in the selected language (e.g., in the French version, only job offers written in French are displayed, and in the English version, only those in English).
Microsoft’s Digital Crimes Unit (DCU) has an immediate opening for a highly qualified cybercrime investigator to immediately handle global investigations and drive high-impact disruption operations targeting sophisticated cybercriminal networks and online threat groups. DCU embodies Microsoft’s commitment to security and continues to innovate and evolve to combat the increasingly sophisticated actors operating in cyberspace. This role will focus on proactive, technical investigations of cyberattacks, fraud and scams, and other online threats directed at Microsoft’s customers and democratic institutions or abusing Microsoft’s products or services, including those leveraging Artificial Intelligence (AI) technology for malicious motives.
Job Responsibility:
Identify and analyze data sources to uncover cybercrime patterns and trends targeting our services and customers
Building proof-of-concept and prototype threat hunting tools, automations, and new capabilities
Collaborate with security engineers and cross-company stakeholders to implement comprehensive investigative and enforcement strategies
Lead and support complex fraud investigations involving cyber‑enabled financial crime, including online scams, business email compromise (BEC), payment fraud, account abuse, and related large‑scale fraud activity
Conduct analysis on large, complex data sets to detect and investigate anomalies, develop actionable insights and strategies
Identify and map malicious technical infrastructure used to facilitate cybercrime
Work independently to detect, investigate, and understand new and emerging cybercrime attack vectors
Partner with DCU attorneys to develop legal strategies to disrupt and impact online criminal networks
Drafting criminal referrals for law enforcement
Provide expert witness testimony in court filings and proceedings
Requirements:
Bachelor’s degree & demonstrable experience in cyber investigations, threat intelligence, or cyber defense operations
Willingness to provide expert witness testimony in court filings and proceedings that will be made public
Proficient with Microsoft SQL Server, KQL, Python, and/or other scripting languages
Proficient knowledge of malware analysis, malware reverse engineering, and behavioral malware analysis
Demonstrated ability to author clear, accurate, and highly technical investigative reports that translate complex technical findings into actionable insights for non-technical audiences, including legal, executive, and law enforcement stakeholders
Ability to meet Microsoft, customer, and/or government security screening requirements for this role (including specialized security screenings)
Microsoft Cloud Background Check: required upon hire/transfer and every two years thereafter
Collaborative, team-first mindset
Proficient written and verbal communication skills, including the ability to translate complex technical findings for a broad range of stakeholders (e.g., law enforcement, legal counsel, and executives)
Nice to have:
Industry certifications related to security and/or investigations (e.g., incident response, computer forensics)
Experience with sophisticated threat actor evidence, including familiarity with common Indicators of Compromise (IOCs), Indicators of Activity (IOAs), and Tools, Techniques, and Procedures (TTPs)
Extensive experience in attribution, creating threat groups, assessing linkages between established threat groups, and communicating attribution assessments to internal stakeholders
Experience leading or supporting complex fraud investigations, including large-scale online fraud, scams, business email compromise (BEC), payment fraud, account abuse, or related cyber-enabled financial crime
Proficiency with attacks on endpoints, cloud, network, and identity-based systems, along with demonstrable investigative practices and communication skills
Published research (blogs, presentations, etc.) on new threat actor TTPs
Experience in cryptocurrency and blockchain investigation tools
Advanced knowledge of network protocols and DNS sinkholing
Advanced knowledge of intelligence analysis and reporting using standard tools and techniques
Advanced skills in analyzing large datasets and developing effective investigative action plans