Incident Response Program Manager

The Trust and Integrity Protection (TrIP) organization helps Microsofts commercial business grow with trust by translating security privacy data-protection regulatory and operational risks into clear decisions effective controls and measurable outcomes.

The TrIP Incident Response team provides incident-response capabilities for in-scope security privacy and data-protection events affecting Microsofts commercial business. The team assesses reported events coordinates containment and remediation supports regulatory and customer-notification decisions maintains incident evidence and works with engineering legal privacy security and business stakeholders through closure.

We are looking for a Incident Response Program Manager to join the TrIP Security Incident Response team. This role will provide hands-on incident coordination and program-management support across a global operating model strengthening coverage and the teams ability to respond to high-priority and concurrent incidents.

The successful candidate will help triage contain investigate document and resolve incidents while coordinating stakeholders and ensuring actions are completed within applicable incident-response regulatory contractual and customer-notification requirements.

The role will also support operational readiness process improvement metrics post-incident learning and the controlled use of automation technologies. This is a hands-on role for someone who combines security knowledge technical program management sound judgment operational discipline and the ability to work effectively through ambiguity.

Microsofts mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset innovate to empower others and collaborate to realize our shared goals. Each day we build on our values of respect integrity and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

Protect customers and the business

• Support timely containment of active or potential data exposure gathering and validating facts needed to assess customer impact affected data impacted environments geographic considerations and potential harm.
• Coordinate with privacy legal security engineering business and customer-facing stakeholders to evaluate regulatory contractual and notification requirements.
• Help ensure that time-sensitive requirements and internal service commitments are identified tracked escalated and completed.
• Support specialized incidents involving delivery partners restricted environments government information and other scenarios that require additional handling controls.

Coordinate incident response

• Triage reported events to determine scope severity ownership required stakeholders and immediate response actions.
• Drive incidents through containment investigation remediation notification assessment evidence collection and closure.
• Coordinate high-priority or non-routine incidents that require rapid escalation specialized engagement or authoritative Microsoft decisions.
• Maintain clear ownership timelines dependencies decisions and next actions throughout the incident lifecycle.
• Participate in a shared on-call rotation providing incident-response coverage.

Drive disciplined case management

• Maintain complete accurate and audit-ready incident records in approved case-management systems.
• Document verified facts incident decisions stakeholders remediation actions approvals communications evidence and closure rationale.
• Monitor active cases aging escalations blockers response commitments and required follow-up actions.
• Coordinate across engineering and business teams to resolve dependencies and keep incidents progressing toward closure.
• Help identify recurring incident patterns control weaknesses process gaps and broader risks discovered through incident investigations.
• Translate operational findings into actionable remediation recommendations and track agreed actions to completion.

Improve incident-response operations

• Analyze operational data and case trends to identify opportunities to improve response quality speed consistency and stakeholder experience.
• Contribute to incident-response metrics dashboards reporting service reviews and leadership updates.
• Develop and maintain runbooks decision trees escalation paths templates operating procedures and readiness materials.
• Participate in post-incident reviews tabletop exercises and continuous-improvement activities.
• Help ensure that operational changes are introduced with defined ownership documented controls appropriate testing and measurable outcomes.
• Partner with vendors and internal teams while maintaining clear Microsoft accountability for governance exceptions approvals and high-risk decisions.
• Support the controlled operation and continued improvement of AI solutions and related incident-response automations.

Build trusted partnerships

• Establish effective working relationships with security privacy legal engineering support business risk compliance and customer-facing teams.
• Communicate incident status risks blockers decisions and required actions clearly to both technical and non-technical stakeholders.
• Facilitate structured discussions during high-pressure situations and drive stakeholders toward clear decisions and accountable actions.
• Operate effectively across global teams cultures organizations and time zones.
• Handle sensitive and confidential incident information with appropriate discretion and care

• Embody our cultureand values

Required Qualifications

• Bachelors Degree AND 2 years experience in engineering product/technical program management data analysis or product development OR equivalent experience.

  1 year(s) of experience managing cross-functional and/or cross-team projects.

Preferred Qualifications

The candidate is a hands-on incident responder and technical program manager who:

• • Is comfortable moving between detailed case execution and broader operational improvement.
  • Communicates clearly with technical teams legal and compliance partners business leaders and customer-facing stakeholders.
  • Uses data and operational evidence to identify patterns and improve controls processes and readiness.
  • Takes ownership and maintains high standards for quality confidentiality and auditability.
  • Experience managing multiple workstreams stakeholders dependencies risks and deadlines in a complex environment.
  • Ability to gather technical and business information distinguish verified facts from assumptions and translate findings into clear actions.
  • Strong written and verbal communication skills including the ability to document decisions operational processes and technical issues clearly.
  • Ability to work through ambiguity adjust priorities during active incidents and maintain effective execution under time-sensitive conditions.
  • Ability to participate in a shared on-call rotation including support outside standard business hours when required.
  • Experience coordinating incident triage containment investigation remediation evidence collection or post-incident reviews.
  • Familiarity with incident and case-management platforms such as ServiceNow or comparable systems.
  • Experience developing or improving operational procedures runbooks escalation paths metrics dashboards and service-management processes.
  • Experience partnering with engineering teams to manage defects operational dependencies production readiness and automation.
  • Familiarity with regulatory contractual customer-notification or government-environment considerations affecting incident response.
  • Has experience leading AI-powered transformation initiatives including the implementation of agentic workflows automation and data-driven solutions at enterprise scale.
  • Creates structure during ambiguous fast-moving and high-pressure situations.

This position will be open for a minimum of 5 days with applications accepted on an ongoing basis until the position is filled.

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age ancestry citizenship color family or medical care leave gender identity or expression genetic information immigration status marital status medical condition national origin physical or mental disability political affiliation protected veteran or military status race ethnicity religion sex (including pregnancy) sexual orientation or any other characteristic protected by applicable local laws regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process read more about requesting accommodations.

Required Experience:

IC