Cybersecurity Infrastructure Engineer - Weekend shift

Microsoft•,

1d•$119,800 - $261,000

About The Position

Microsoft's Detection and Response Team (DART) is seeking a Cybersecurity Infrastructure Engineer to support customers during high-impact cybersecurity incidents. DART helps customers contain and recover from incidents and build resilience against future threats. This customer-facing role leads infrastructure recovery and identity-containment workstreams, establishes technical priorities, and partners with customers to make evidence-led recovery decisions and improve security outcomes. The engineer works alongside investigators, threat hunters, reverse engineers, and incident coordinators, and contributes practical recovery expertise, colleague mentoring, and the development of Defender Experts Cybersecurity Incident Response. The role supports evidence-driven infrastructure response, identity recovery, and technical hardening across enterprise on-premises and cloud environments. It includes setting recovery objectives and evidence requirements; assessing compromise, recovery readiness, trust relationships, privileged access, and security gaps; guiding response decisions that balance containment, evidence preservation, urgency, and business constraints; and communicating findings and options to technical teams, executives, and internal stakeholders. The position also contributes to proactive services such as compromise assessments, identity posture reviews, and infrastructure resilience improvements. This role requires a non-standard Friday-through-Monday schedule: a 10-hour shift scheduled between 8:00 AM and 6:00 PM EDT, including weekends and public holidays. Substitute days off are provided for public holiday work. Hours may change based on business needs. Microsoft and customer or government security screening requirements apply, including a Microsoft Cloud Background Check and any additional checks required for customer or government work.

Requirements

Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or a related field; or a master's degree in one of those fields plus 3+ years of experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection; or a bachelor's degree in one of those fields plus 4+ years of such experience; or equivalent experience.
Ability to meet Microsoft, customer, and/or government security screening requirements, including a Microsoft Cloud Background Check and any additional checks required for customer or government work.
Ability to work the stated non-standard Friday-through-Monday schedule, including weekends and public holidays; hours may change based on business needs.

Nice To Haves

Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or a related field plus 3+ years of experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection; or a master's degree in one of those fields plus 6+ years of such experience; or a bachelor's degree in one of those fields plus 8+ years of such experience; or equivalent experience.
Hands-on experience with Active Directory, Entra ID, or other enterprise identity platforms in complex enterprise environments.
Strong understanding of identity-related attack techniques, including Golden Ticket, Pass-the-Hash, Kerberoasting, credential theft, privilege escalation, and lateral movement.
Experience supporting identity recovery, infrastructure recovery, and post-breach hardening decisions under operational pressure.
Familiarity with Windows Server infrastructure, DNS, DHCP, Group Policy, privileged access, and hybrid identity dependencies.
Ability to script or automate recovery, validation, or analysis tasks using PowerShell or similar tools.
Ability to clearly explain technical findings, dependencies, risks, and residual uncertainty to customers and internal stakeholders.
Flexibility to work non-standard business hours that may include evenings, nighttime, weekends, and/or holidays.
Experience in cybersecurity incident response, digital forensics, threat hunting, or enterprise recovery.
Familiarity with Microsoft Defender XDR, Microsoft Sentinel, Entra ID, Microsoft Graph, Azure, Windows security eventing, and third-party SIEM/SOAR or EDR platforms.
Experience leading infrastructure workstreams in high-pressure, customer-facing incident response while balancing investigation, containment, and recovery needs.
Ability to translate technical constraints into practical response plans and executive-ready recommendations.
Relevant security, identity, cloud, or incident response certifications, or equivalent practical expertise.
Research, analytical automation, data-quality improvement, or technical mentoring that strengthens infrastructure response capability.

Responsibilities

Set infrastructure recovery objectives, technical priorities, and evidence requirements for identity, directory, privileged access, and enterprise infrastructure workstreams.
Lead or support containment and recovery for compromised Active Directory, Entra ID, Tier 0, and hybrid infrastructure environments.
Assess compromise scope, recovery readiness, trust relationships, privileged access pathways, and security-control gaps; identify known facts, uncertainties, and required validation.
Direct or guide technical response activities while balancing containment, recovery urgency, evidence preservation, and customer business constraints.
Collect, preserve, and analyze infrastructure and identity evidence for investigation, containment, and recovery decisions.
Serve as a technical point of contact for infrastructure recovery and brief customer technical teams, executives, and internal stakeholders on findings, priorities, and decision options.
Identify skill, access, telemetry, and resource gaps; coordinate with incident coordinators and leadership to resolve dependencies, obtain specialist support, and escalate delivery risks.
Maintain technical documentation and follow-the-sun handovers covering evidence, decisions, risks, dependencies, and next actions; support final reporting and lessons learned.
Contribute to proactive services, including compromise assessments, identity posture reviews, and infrastructure resilience improvements.
Share recovery expertise, mentor colleagues, and help shape Defender Experts Cybersecurity Incident Response.