Overview
The Cyber Defense Investigations – Escalations CDI-ESC team is Microsoft’s deep-dive investigative arm within Cyber Defense Operations CDO. We lead the most complex, high-severity, and nation-state security incidents across Microsoft’s first-party cloud estate, bringing together investigators, threat hunters, security engineers, intelligence teams, and service owners to understand and respond to sophisticated security threats.
We are seeking a Technical Program Manager to help drive the programs, processes, and operational mechanisms that enable CDI-ESC to respond effectively at scale. In this role, you will work alongside security investigators, engineering teams, and CDO partners to coordinate priorities, track complex workstreams, improve operational processes, and ensure important security initiatives move from planning through execution.
You do not need to be the deepest technical security expert in the room. You will be expected to develop a strong understanding of our security operations, ask the right questions, bring structure to ambiguous problems, and help technical teams stay aligned and focused. You will turn technical and operational inputs into clear plans, actions, risks, dependencies, and measurable outcomes.
This is an opportunity to grow your technical program management skills while working directly with teams responding to some of Microsoft’s most challenging cybersecurity incidents.
Responsibilities
- Coordinate security programs and operational initiatives by helping define objectives, milestones, owners, dependencies, timelines, and success measures and maintaining visibility into progress from planning through completion.
- Support complex incident and investigation workstreams by coordinating activities across CDI-ESC, threat intelligence, incident coordination, containment, detection engineering, service teams, and other CDO partners.
- Build and maintain program mechanisms such as roadmaps, trackers, dashboards, operating rhythms, action-item management, decision logs, and status reporting that help technical teams execute consistently.
- Drive follow-through and accountability by tracking commitments, identifying blockers and dependencies, escalating risks when appropriate, and helping ensure actions and decisions reach closure.
- Improve team processes and workflows by identifying opportunities to simplify repetitive work, strengthen handoffs, document standards, automate manual processes, and make operational practices more repeatable.
- Use data, telemetry, and AI-assisted tools to help identify trends, measure program health, automate routine program-management activities, and improve the speed and quality of operational decision-making.
- Translate technical information into clear communications by working with security investigators and engineers to summarize program status, risks, dependencies, decisions, and outcomes for technical and leadership audiences.
- Support retrospectives and con
