Microsoft Security Research is at the front line of defending Microsoft customers and the broader ecosystem against the world's most sophisticated threat actors. Our Applied Threat Intelligence team ...
Microsoft Security Research is at the front line of defending Microsoft customers and the broader ecosystem against the world's most sophisticated threat actors. Our Applied Threat Intelligence team ...
Hands-on experience with threat-intelligence and detection tooling (e.g., threat-intelligence platforms such as MISP, SIEM, EDR/NDR) and open-source research techniques * Understanding of common ...
New
Hands-on experience with threat-intelligence and detection tooling (e.g., threat-intelligence platforms such as MISP, SIEM, EDR/NDR) and open-source research techniques * Understanding of common ...
New
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
Conduct open-source intelligence (OSINT) research on emerging threats, malware, and threat actors. * Support senior analysts with intelligence reports, threat briefs, and daily/weekly summaries.
Conduct open-source intelligence (OSINT) research on emerging threats, malware, and threat actors. * Support senior analysts with intelligence reports, threat briefs, and daily/weekly summaries.
Richardson,TX 5 days onsite Only W2 Cyber Threat Intelligence team reduces cyber risk by identifying the latest threats through research, information sharing within similar business organizations ...
Richardson,TX 5 days onsite Only W2 Cyber Threat Intelligence team reduces cyber risk by identifying the latest threats through research, information sharing within similar business organizations ...
Senior Applied Threat Intelligence Analyst - Microsoft Security Threat Response
Redmond, WA · On-site
Microsoft Security Research, is at the front line of defending Microsoft customers and the broader ecosystem against the world's most sophisticated threat actors. Our Applied Threat Intelligence ...
Senior Applied Threat Intelligence Analyst - Microsoft Security Threat Response
Redmond, WA · On-site
Microsoft Security Research, is at the front line of defending Microsoft customers and the broader ecosystem against the world's most sophisticated threat actors. Our Applied Threat Intelligence ...
Hands-on experience with threat-intelligence and detection tooling (e.g., threat-intelligence platforms such as MISP, SIEM, EDR/NDR) and open-source research techniques * Understanding of common ...
New
Hands-on experience with threat-intelligence and detection tooling (e.g., threat-intelligence platforms such as MISP, SIEM, EDR/NDR) and open-source research techniques * Understanding of common ...
New
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
Threat Intelligence Collection: Assist in the proactive research, identification, and collection of threat intelligence from various sources, including open-source intelligence (OSINT), commercial ...
Threat Intelligence Collection: Assist in the proactive research, identification, and collection of threat intelligence from various sources, including open-source intelligence (OSINT), commercial ...
Hands-on experience with threat-intelligence and detection tooling (e.g., threat-intelligence platforms such as MISP, SIEM, EDR/NDR) and open-source research techniques * Understanding of common ...
New
Hands-on experience with threat-intelligence and detection tooling (e.g., threat-intelligence platforms such as MISP, SIEM, EDR/NDR) and open-source research techniques * Understanding of common ...
New
Hands-on experience with threat-intelligence and detection tooling (e.g., threat-intelligence platforms such as MISP, SIEM, EDR/NDR) and open-source research techniques * Understanding of common ...
New
Hands-on experience with threat-intelligence and detection tooling (e.g., threat-intelligence platforms such as MISP, SIEM, EDR/NDR) and open-source research techniques * Understanding of common ...
New
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
Conduct open-source intelligence (OSINT) research on emerging threats, malware, and threat actors. * Support senior analysts with intelligence reports, threat briefs, and daily/weekly summaries.
Conduct open-source intelligence (OSINT) research on emerging threats, malware, and threat actors. * Support senior analysts with intelligence reports, threat briefs, and daily/weekly summaries.
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
This role is focused on hands-on cyber threat intelligence analysis, intelligence production, threat actor research, and turning complex threat information into clear, actionable insights for ...
Threat Intelligence Researcher information
See salary details
$30K - $42.2K
4% of jobs
$42.2K - $54.5K
3% of jobs
$54.5K - $66.7K
18% of jobs
$67K is the 25th percentile. Wages below this are outliers.
$66.7K - $78.9K
9% of jobs
$78.9K - $91.1K
8% of jobs
$91.1K - $103.4K
3% of jobs
$103.4K - $115.6K
3% of jobs
The median wage is $120.2K / yr.
$115.6K - $127.8K
4% of jobs
$127.8K - $140K
3% of jobs
$140K - $152.3K
3% of jobs
$157.1K is the 75th percentile. Wages above this are outliers.
$152.3K - $164.5K
41% of jobs
$30K
$113.1K
$164.5K
How much do threat intelligence researcher jobs pay per year?
As of Aug 9, 2026, the average yearly pay for threat intelligence researcher in the United States is $113,102.00, according to ZipRecruiter salary data. Most workers in this role earn between $67,000.00 and $154,000.00 per year, depending on experience, location, and employer.
What skills and qualifications are needed to be a threat intelligence researcher?
To thrive as a Threat Intelligence Researcher, you need strong analytical skills, cybersecurity knowledge, and experience with threat detection, often supported by a degree in computer science or a related field. Familiarity with threat intelligence platforms (TIPs), SIEM systems, malware analysis tools, and certifications like GIAC or CEH are commonly required. Excellent critical thinking, attention to detail, and effective communication skills help you interpret complex data and share findings with technical and non-technical audiences. These skills are essential for proactively identifying, analyzing, and mitigating cyber threats to protect organizational assets.
What is the difference between Threat Intelligence Researcher vs Cybersecurity Analyst?
| Aspect | Threat Intelligence Researcher | Cybersecurity Analyst |
|---|---|---|
| Required Credentials | Bachelor's in Cybersecurity, Computer Science, or related; certifications like GIAC, CISSP | Bachelor's in Cybersecurity, Information Technology, or related; similar certifications often preferred |
| Work Environment | Research-focused, analyzing threat data, monitoring cyber threats | Operational, monitoring security systems, incident response |
| Employer & Industry Usage | Tech firms, government agencies, security consultancies | Organizations across industries, including finance, healthcare, and government |
| Common Search & Comparison | Threat Intelligence Researcher vs Cybersecurity Analyst |
Both roles require cybersecurity knowledge and certifications, but Threat Intelligence Researchers focus on analyzing and understanding emerging threats, while Cybersecurity Analysts handle day-to-day security monitoring and incident response. The roles often overlap but differ mainly in scope and focus area.
What does a threat intelligence researcher do?
A Threat Intelligence Researcher is responsible for identifying, analyzing, and reporting on cyber threats and vulnerabilities that could impact an organization. They collect data from various sources, such as the dark web, threat feeds, and security incidents, to understand the tactics, techniques, and procedures used by threat actors. Their work helps organizations anticipate, prepare for, and defend against cyber attacks by providing actionable intelligence to security teams. Additionally, they may contribute to developing threat detection tools and policies to enhance overall cybersecurity posture.
How does a threat intelligence researcher collaborate with other cybersecurity teams?
Threat Intelligence Researchers work closely with various cybersecurity teams, such as incident response, security operations, and vulnerability management. They provide actionable intelligence by analyzing emerging threats, sharing timely reports, and advising on mitigation strategies. Effective collaboration often involves regular briefings, cross-team meetings, and real-time communication to ensure that threat data is integrated into broader security operations. This teamwork helps organizations respond proactively to evolving cyber threats.
More about Threat Intelligence Researcher jobs
What cities are hiring for Threat Intelligence Researcher jobs? Cities with the most Threat Intelligence Researcher job openings:
What states have the most Threat Intelligence Researcher jobs? States with the most job openings for Threat Intelligence Researcher jobs include:
What job categories do people searching Threat Intelligence Researcher jobs look for? The top searched job categories for Threat Intelligence Researcher jobs are:
Full-time
Re-posted 8 days ago
Microsoft rating
8.5
Based on 132 frontline employees who took The Breakroom Quiz
78th of 242 rated software companies
Job description
Overview
Security represents the most critical priorities for our customers in a world awash in digital threats, regulatory scrutiny, and estate complexity. Microsoft Security aspires to make the world a safer place for all. We want to reshape security and empower every user, customer, and developer with a security cloud that protects them with end to end, simplified solutions. The Microsoft Security organization accelerates Microsoft's mission and bold ambitions to ensure that our company and industry is securing digital technology platforms, devices, and clouds in our customers' heterogeneous environments, as well as ensuring the security of our own internal estate.
Microsoft Security Research is at the front line of defending Microsoft customers and the broader ecosystem against the world's most sophisticated threat actors. Our Applied Threat Intelligence team tracks the threat landscape and the threat actors that target our customers; where they have been, where they are today, and predict where they will be tomorrow. We partner deeply across Microsoft Threat Intelligence, product engineering, and research to ensure our customers stay ahead of threats.
Responsibilities
Qualifications
Minimum Qualifications:
Other Requirements:
Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings:
Microsoft Cloud Background Check:
Preferred Qualifications:
#MSSecurity
Security Research IC3 - The typical base pay range for this role across the U.S. is USD $102,100 - $202,200 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $133,800 - $219,200 per year.
Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
https://careers.microsoft.com/us/en/us-corporate-pay
Security Research IC4 - The typical base pay range for this role across the U.S. is USD $119,800 - $234,700 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $160,200 - $261,000 per year.
Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
https://careers.microsoft.com/us/en/us-corporate-pay
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.
Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.
Security represents the most critical priorities for our customers in a world awash in digital threats, regulatory scrutiny, and estate complexity. Microsoft Security aspires to make the world a safer place for all. We want to reshape security and empower every user, customer, and developer with a security cloud that protects them with end to end, simplified solutions. The Microsoft Security organization accelerates Microsoft's mission and bold ambitions to ensure that our company and industry is securing digital technology platforms, devices, and clouds in our customers' heterogeneous environments, as well as ensuring the security of our own internal estate.
Microsoft Security Research is at the front line of defending Microsoft customers and the broader ecosystem against the world's most sophisticated threat actors. Our Applied Threat Intelligence team tracks the threat landscape and the threat actors that target our customers; where they have been, where they are today, and predict where they will be tomorrow. We partner deeply across Microsoft Threat Intelligence, product engineering, and research to ensure our customers stay ahead of threats.
Responsibilities
- Lead with AI to understand the threat landscape and the latest attacker tradecraft.
- Track threat actors, including financially motivated threat actors; their infrastructure, their targets, and their shifting techniques, tactics, and procedures.
- Translate complex technical findings into clear, prescriptive guidance for security operations teams, executives, and the broader defender community.
- Partner with product, research, marketing, and communications teams to ensure high-quality intelligence experiences through Microsoft's customer-facing surfaces and managed services (Agentic Security, Defender XDR, Defender Experts, Sentinel, blogs, briefings).
- Build and refine the pipelines, tooling, and workflows that allow Microsoft to stream insightful cyber threat intelligence to customers machine speed.
- Represent Microsoft Threat Intelligence in customer briefings, industry conferences, and cross-industry working groups.
Qualifications
Minimum Qualifications:
- Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
- OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
- OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 6+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
- OR equivalent experience.
Other Requirements:
Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings:
Microsoft Cloud Background Check:
- This position will be required to pass the Microsoft background and Microsoft Cloud background check upon hire/transfer and every two years thereafter.
Preferred Qualifications:
- Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 5+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
- OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 8+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
- OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 12+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
- OR equivalent experience.
- 3+ years of experience in cyber threat intelligence, threat hunting, incident response, or a closely related security discipline.
- Attribution experience creating threat groups, assessing connections between established threat groups, and communicating attribution assessments to internal stakeholders and customers in a timely manner.
- Demonstrated experience producing finished threat intelligence reporting for technical and/or executive audiences.
- Working experience with Microsoft Sentinel and Microsoft Defender XDR (or directly comparable SIEM/XDR platforms).
- Understanding of adversary tradecraft, the cyber kill chain, and frameworks such as MITRE ATT&CK, the Diamond Model, and structured analytic techniques.
- Written and verbal communication skills, with a portfolio of public or customer-facing intelligence writing.
- Experience tracking and defending against financially motivated threat actors.
- Experience with endpoint, cloud, network, and identity-based attacks and datasets.
- Experience with AI tools and large language models, building agents and skills for information security applications and pipelines.
- Comprehensive OS security/internals knowledge.
- Understanding of network protocols and analytical experience with network infrastructure data & telemetry.
- Reverse-engineering with static and behavioral binary analysis experience.
- Functional understanding of common threat analysis models such as the Diamond Model, Cyber Kill Chain, and MITRE ATT&CK.
- Programming or scripting background (Python, PowerShell, C#, C++, etc.).
#MSSecurity
Security Research IC3 - The typical base pay range for this role across the U.S. is USD $102,100 - $202,200 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $133,800 - $219,200 per year.
Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
https://careers.microsoft.com/us/en/us-corporate-pay
Security Research IC4 - The typical base pay range for this role across the U.S. is USD $119,800 - $234,700 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $160,200 - $261,000 per year.
Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
https://careers.microsoft.com/us/en/us-corporate-pay
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.
Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.
What Microsoft employees say
Pay
Benefits
Hours and flexibility
Workplace
Get the full story on Breakroom
About Microsoft
Sourced by ZipRecruiter
Our infrastructure is comprised of a large global portfolio of more than 100 datacenters and 1 million servers. Our foundation is built upon and managed by a team of subject matter experts working to support services for more than 1 billion customers and 20 million businesses in over 90 countries worldwide. With environmental sustainability and optimization at the forefront of our datacenter design and operations, we continue to grow and evolve as we meet the ever-changing business demands that hold Microsoft as a world-class cloud provider.
Industry
Computer and computer peripheral equipment and software wholesalers
Company size
10,000+ Employees
Headquarters location
Redmond, WA, US
Year founded
1975