Overview
Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.
As a member of the Microsoft Threat Protection Security Research team, you’ll join a diverse global community of engineers, program managers, data scientists, security researchers, and threat hunters who apply deep knowledge of attacker tactics and cutting-edge technology to protect customers. We are looking for a Senior Technical Program Manager to join our Threat Response team. The Threat Response team leads Microsoft Security’s response to high-severity security incidents, coordinating research, engineering, threat intelligence, and communications teams to get validated, actionable protection guidance to customers quickly. In this role, you will act as a Crisis Manager for complex incidents, own improvements across several incident response processes and tools, and help bring AI and automation into how we respond. This is a role for an experienced program manager who can work independently, influence across teams, and help grow the people around them.
Responsibilities
- Incident leadership: Act as Crisis Manager for complex, high-severity security incidents with limited oversight.
- Coordinate response teams, make timely priority calls, and drive fast delivery of validated, actionable protection guidance to customers.
- Take part in an on-call rotation, including occasional after-hours and weekend coverage.
- Program definition and metrics: Identify complex gaps and opportunities across multiple incident response processes and tools, using incident data, response trends, and post-incident findings to spot patterns and build improvement plans.
- Define program goals, priorities, success criteria, and performance metrics, such as time to declare, time to customer guidance, and SLA adherence.
- Cross-team orchestration: Build relationships across security research, engineering, threat intelligence, and communications teams to drive coordinated action during and after incidents.
- Influence peers and partner teams with data and clear reasoning, and give leadership concise updates on incident status, impact, and next steps.
- Project management and execution: Track, coordinate, and communicate end-to-end schedules across multiple workstreams. Establish and monitor processes, hold stakeholders accountable, manage dependencies, identify risks and escalate appropriately, and make course corrections when work drifts from goals.
- Contribute to pilot and rollout plans aligned with team OKRs and KPIs. Engineering partnership and AI/automation: Partner with engineering on incident response tooling and roadmap priorities.
- Build your own AI skills to streamline
