OverviewThe TrIP Incident Response team provides incident-response capabilities for in-scope security, privacy, and data-protection events affecting Microsoft's commercial business. The team assesses reported events, coordinates containment and remediation, supports regulatory and customer-notification decisions, maintains incident evidence, and works with engineering, legal, privacy, security, and business stakeholders through closure.
We are looking for a Incident Response Program Manager to join the TrIP Security Incident Response team. This role will provide hands-on incident coordination and program-management support across a global operating model, strengthening coverage and the team's ability to respond to high-priority and concurrent incidents.
The successful candidate will help triage, contain, investigate, document, and resolve incidents while coordinating stakeholders and ensuring actions are completed within applicable incident-response, regulatory, contractual, and customer-notification requirements.
The role will also support operational readiness, process improvement, metrics, post-incident learning, and the controlled use of automation technologies. This is a hands-on role for someone who combines security knowledge, technical program management, sound judgment, operational discipline, and the ability to work effectively through ambiguity.
ResponsibilitiesProtect customers and the business- Support timely containment of active or potential data exposure, gathering and validating facts needed to assess customer impact, affected data, impacted environments, geographic considerations, and potential harm.
- Coordinate with privacy, legal, security, engineering, business, and customer-facing stakeholders to evaluate regulatory, contractual, and notification requirements.
- Help ensure that time-sensitive requirements and internal service commitments are identified, tracked, escalated, and completed.
- Support specialized incidents involving delivery partners, restricted environments, government information, and other scenarios that require additional handling controls.
Coordinate incident response- Triage reported events to determine scope, severity, ownership, required stakeholders, and immediate response actions.
- Drive incidents through containment, investigation, remediation, notification assessment, evidence collection, and closure.
- Coordinate high-priority or non-routine incidents that require rapid escalation, specialized engagement, or authoritative Microsoft decisions.
- Maintain clear ownership, timelines, dependencies, decisions, and next actions throughout the incident lifecycle.
- Participate in a shared on-call rotation providing incident-response coverage.
Drive disciplined case management- Maintain complete, accurate, and audit-ready incident records in approved case-management systems.
- Document verified facts, incident decisions, stakeholders, remediation actions, approvals, communications, evidence, and closure rationale.
- Monitor active cases, aging, escalations, blockers, response commitments, and required follow-up actions.
- Coordinate across engineering and business teams to resolve dependencies and keep incidents progressing toward closure.
- Help identify recurring incident patterns, control weaknesses, process gaps, and broader risks discovered through incident investigations.
- Translate operational findings into actionable remediation recommendations and track agreed actions to completion.
Improve incident-response operations- Analyze operational data and case trends to identify opportunities to improve response quality, speed, consistency, and stakeholder experience.
- Contribute to incident-response metrics, dashboards, reporting, service reviews, and leadership updates.
- Develop and maintain runbooks, decision trees, escalation paths, templates, operating procedures, and readiness materials.
- Participate in post-incident reviews, tabletop exercises, and continuous-improvement activities.
- Help ensure that operational changes are introduced with defined ownership, documented controls, appropriate testing, and measurable outcomes.
- Partner with vendors and internal teams while maintaining clear Microsoft accountability for governance, exceptions, approvals, and high-risk decisions.
- Support the controlled operation and continued improvement of AI solutions and related incident-response automations.
Build trusted partnerships- Establish effective working relationships with security, privacy, legal, engineering, support, business, risk, compliance, and customer-facing teams.
- Communicate incident status, risks, blockers, decisions, and required actions clearly to both technical and non-technical stakeholders.
- Facilitate structured discussions during high-pressure situations and drive stakeholders toward clear decisions and accountable actions.
- Operate effectively across global teams, cultures, organizations, and time zones.
- Handle sensitive and confidential incident information with appropriate discretion and care
- Embody our culture and values
QualificationsRequired Qualifications- Bachelor's Degree AND 2+ years experience in engineering, product/technical program management, data analysis, or product development OR equivalent experience.
1+ year(s) of experience managing cross-functional and/or cross-team projects.
Preferred Qualifications The candidate is a hands-on incident responder and technical program manager who:
- Is comfortable moving between detailed case execution and broader operational improvement.
- Communicates clearly with technical teams, legal and compliance partners, business leaders, and customer-facing stakeholders.
- Uses data and operational evidence to identify patterns and improve controls, processes, and readiness.
- Takes ownership and maintains high standards for quality, confidentiality, and auditability.
- Experience managing multiple workstreams, stakeholders, dependencies, risks, and deadlines in a complex environment.
- Ability to gather technical and business information, distinguish verified facts from assumptions, and translate findings into clear actions.
- Strong written and verbal communication skills, including the ability to document decisions, operational processes, and technical issues clearly.
- Ability to work through ambiguity, adjust priorities during active incidents, and maintain effective execution under time-sensitive conditions.
- Ability to participate in a shared on-call rotation, including support outside standard business hours when required.
- Experience coordinating incident triage, containment, investigation, remediation, evidence collection, or post-incident reviews.
- Familiarity with incident and case-management platforms such as ServiceNow, or comparable systems.
- Experience developing or improving operational procedures, runbooks, escalation paths, metrics, dashboards, and service-management processes.
- Experience partnering with engineering teams to manage defects, operational dependencies, production readiness, and automation.
- Familiarity with regulatory, contractual, customer-notification, or government-environment considerations affecting incident response.
- Has experience leading AI-powered transformation initiatives, including the implementation of agentic workflows, automation, and data-driven solutions at enterprise scale.
- Creates structure during ambiguous, fast-moving, and high-pressure situations.
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.
