Government Cloud Investigations Analyst - CTJ - Secret
Overview
The Government Cloud Investigations Analyst is a specialized member of Microsoft’s Fraud & Vetting Operations (FVO), responsible for conducting high-impact investigations into fraud, abuse, and security incidents within U.S. Government cloud environments (e.g., Azure Government, GCC, GCC High, DoD).
This role operates in a high-trust, regulated environment, requiring strict adherence to federal compliance frameworks (e.g., CJIS, FedRAMP, DoD SRG) while delivering audit-defensible, evidence-based investigative outcomes that protect government customers, national interests, and Microsoft services.
The analyst functions within a fraud-first, threat-actor-informed model, partnering with engineering, legal, compliance, and government stakeholders to detect, investigate, and remediate sophisticated threats.
Responsibilities
- Investigations & Analysis
- Conduct deep-dive investigations into:
- Fraud-from-birth tenants, account compromise, abuse of government cloud resources
- Insider risk, misuse of privileged access, and policy violations within regulated environments
- Correlate signals across identity, billing, telemetry, and cross-tenant activity to reconstruct attack timelines and determine root cause
- Differentiate fraud vs. compromise vs. legitimate activity using structured decision frameworks and evidence correlation
- Incident Response & Escalation
- Own or support Sev-1 / Sev-2 incidents within Government cloud environments
- Execute containment actions:
- Account disablement, service restrictions, tenant isolation, enforcement actions
- Coordinate with:
- Legal, Privacy, Engineering, and Federal engagement teams
- Provide executive-ready risk assessments and case summaries for high-visibility incidents
- Case Ownership & Operational Excellence
- Manage investigations end-to-end:
- Intake → Investigation → Containment → Documentation → Closure
- Ensure SLA adherence (time-to-contain, response timelines, throughput)
- Maintain high-quality, audit-ready documentation aligned to policy and compliance standards
- Serve as final decision authority for investigative disposition in assigned cases
- Threat Hunting & Proactive Detection
- Identify emerging fraud patterns and adversary modus operandi (MO)
- Partner with threat hunting teams to:
- Surface unknown threats
- Validate detection gaps
- Feed improvements into detection systems
- Contribute to proactiv...
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis.