Incident Response Program Manager

The Trust and Integrity Protection (TrIP) organization helps Microsoft’s commercial business grow with trust by translating security, privacy, data-protection, regulatory, and operational risks into clear decisions, effective controls, and measurable outcomes.

The TrIP Incident Response team provides incident-response capabilities for in-scope security, privacy, and data-protection events affecting Microsoft’s commercial business. The team assesses reported events, coordinates containment and remediation, supports regulatory and customer-notification decisions, maintains incident evidence, and works with engineering, legal, privacy, security, and business stakeholders through closure.

We are looking for a Incident Response Program Manager to join the TrIP Security Incident Response team. This role will provide hands-on incident coordination and program-management support across a global operating model, strengthening coverage and the team’s ability to respond to high-priority and concurrent incidents.

The successful candidate will help triage, contain, investigate, document, and resolve incidents while coordinating stakeholders and ensuring actions are completed within applicable incident-response, regulatory, contractual, and customer-notification requirements.

The role will also support operational readiness, process improvement, metrics, post-incident learning, and the controlled use of automation technologies. This is a hands-on role for someone who combines security knowledge, technical program management, sound judgment, operational discipline, and the ability to work effectively through ambiguity.

Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

Protect customers and the business

• Support timely containment of active or potential data exposure, gathering and validating facts needed to assess customer impact, affected data, impacted environments, geographic considerations, and potential harm.
• Coordinate with privacy, legal, security, engineering, business, and customer-facing stakeholders to evaluate regulatory, contractual, and notification requirements.
• Help ensure that time-sensitive requirements and internal service commitments are identified, tracked, escalated, and completed.
• Support specialized incidents involving delivery partners, restricted environments, government information, and other scenarios that require additional handling controls.

Coordinate incident response

• Triage reported events to determine scope, severity, ownership, required stakeholders, and immediate response actions.
• Drive incidents through containment, investigation, remediation, notification assessment, evidence collection, and closure.
• Coordinate high-priority or non-routine incidents that require rapid escalation, specialized engagement, or authoritative Microsoft decisions.
• Maintain clear ownership, timelines, dependencies, decisions, and next actions throughout the incident lifecycle.
• Participate in a shared on-call rotation providing incident-response coverage.

Drive disciplined case management

• Maintain complete, accurate, and audit-ready incident records in approved case-management systems.
• Document verified facts, incident decisions, stakeholders, remediation actions, approvals, communications, evidence, and closure rationale.
• Monitor active cases, aging, escalations, blockers, response commitments, and required follow-up actions.
• Coordinate across engineering and business teams to resolve dependencies and keep incidents progressing toward closure.
• Help identify recurring incident patterns, control weaknesses, process gaps, and broader risks discovered through incident investigations.
• Translate operational findings into actionable remediation recommendations and track agreed actions to completion.

Improve incident-response operations

• Analyze operational data and case trends to identify opportunities to improve response quality, speed, consistency, and stakeholder experience.
• Contribute to incident-response metrics, dashboards, reporting, service reviews, and leadership updates.
• Develop and maintain runbooks, decision trees, escalation paths, templates, operating procedures, and readiness materials.
• Participate in post-incident reviews, tabletop exercises, and continuous-improvement activities.
• Help ensure that operational changes are introduced with defined ownership, documented controls, appropriate testing, and measurable outcomes.
• Partner with vendors and internal teams while maintaining clear Microsoft accountability for governance, exceptions, approvals, and high-risk decisions.
• Support the controlled operation and continued improvement of AI solutions and related incident-response automations.

Build trusted partnerships

• Establish effective working relationships with security, privacy, legal, engineering, support, business, risk, compliance, and customer-facing teams.
• Communicate incident status, risks, blockers, decisions, and required actions clearly to both technical and non-technical stakeholders.
• Facilitate structured discussions during high-pressure situations and drive stakeholders toward clear decisions and accountable actions.
• Operate effectively across global teams, cultures, organizations, and time zones.
• Handle sensitive and confidential incident information with appropriate discretion and care

• Embody our culture and values

Required Qualifications

• Bachelor's Degree AND 2+ years experience in engineering, product/technical program management, data analysis, or product development OR equivalent experience.
  1+ year(s) of experience managing cross-functional and/or cross-team projects.

Preferred Qualifications

    The candidate is a hands-on incident responder and technical program manager who:

• • Is comfortable moving between detailed case execution and broader operational improvement.
  • Communicates clearly with technical teams, legal and compliance partners, business leaders, and customer-facing stakeholders.
  • Uses data and operational evidence to identify patterns and improve controls, processes, and readiness.
  • Takes ownership and maintains high standards for quality, confidentiality, and auditability.
  • Experience managing multiple workstreams, stakeholders, dependencies, risks, and deadlines in a complex environment.
  • Ability to gather technical and business information, distinguish verified facts from assumptions, and translate findings into clear actions.
  • Strong written and verbal communication skills, including the ability to document decisions, operational processes, and technical issues clearly.
  • Ability to work through ambiguity, adjust priorities during active incidents, and maintain effective execution under time-sensitive conditions.
  • Ability to participate in a shared on-call rotation, including support outside standard business hours when required.
  • Experience coordinating incident triage, containment, investigation, remediation, evidence collection, or post-incident reviews.
  • Familiarity with incident and case-management platforms such as ServiceNow, or comparable systems.
  • Experience developing or improving operational procedures, runbooks, escalation paths, metrics, dashboards, and service-management processes.
  • Experience partnering with engineering teams to manage defects, operational dependencies, production readiness, and automation.
  • Familiarity with regulatory, contractual, customer-notification, or government-environment considerations affecting incident response.
  •  Has experience leading AI-powered transformation initiatives, including the implementation of agentic workflows, automation, and data-driven solutions at enterprise scale.
  • Creates structure during ambiguous, fast-moving, and high-pressure situations.

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.