Cybersecurity Lead Investigator - Weekend shift

Microsoft•,

14h•$119,800 - $261,000

About The Position

Microsoft's Detection and Response Team (DART) is seeking a Cybersecurity Lead Investigator to lead customer-facing investigations during security incidents. The role sets investigation direction and technical priorities, guides evidence-led response decisions, and serves as the primary technical point of contact for customers, including executive stakeholders. The investigator coordinates threat hunters, reverse engineers, infrastructure engineers, and incident coordinators to align specialist workstreams and explain findings, confidence, risk, and response options. The position also contributes to a globally distributed team by sharing research, mentoring colleagues, and helping shape Defender Experts Cybersecurity Incident Response. This role has a Friday-through-Monday shift assignment of 10 hours scheduled between 8:00 AM and 6:00 PM EDT, including weekends and public holidays. Substitute days off are provided for public holiday work. Working hours may change based on business needs. Microsoft, customer, and/or government security screening requirements apply, including a Microsoft Cloud Background Check and any additional checks required for customer or government work.

Requirements

Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or a related field; or a master's degree in one of these fields and 3+ years of relevant experience; or a bachelor's degree in one of these fields and 4+ years of relevant experience; or equivalent experience.
Relevant experience includes software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
Ability to meet Microsoft, customer, and/or government security screening requirements, including a Microsoft Cloud Background Check and any additional checks required for customer or government work.
Ability to work the assigned Friday-through-Monday schedule, including weekends and public holidays; working hours may change based on business needs.

Nice To Haves

Doctorate in a listed field and 3+ years of relevant experience; or master's degree and 6+ years; or bachelor's degree and 8+ years; or equivalent experience.
Hands-on experience leading large-scale, high-pressure cybersecurity incident response across on-premises and cloud environments, setting investigation direction, and guiding evidence-driven customer decisions.
Ability to correlate and assess evidence from multiple sources, reconstruct incident timelines, evaluate compromise scope and possible exfiltration, and explain findings and uncertainty.
Experience directing response activities while balancing rapid recovery, technical dependencies, and business impact.
Ability to lead technical specialists and stakeholders, identify engagement gaps, request resources, and manage investigations using a global follow-the-sun model.
Customer-facing written and verbal communication skills, including executive briefings.
Flexibility to work non-standard hours that may include evenings, nights, weekends, and/or holidays.
Experience analyzing nation-state or cybercrime activity and applying adversary knowledge to complex enterprise investigations.
Research, analytical automation, data-quality improvement, and technical mentoring that strengthen investigation capability.
Experience developing reviewed technical publications, presentations, or other knowledge-sharing material while protecting sensitive information.
Experience leading globally distributed incident response workstreams with clear handovers, explicit ownership, and effective customer communication.
Relevant security certifications or equivalent practical expertise.

Responsibilities

Set investigation objectives, hypotheses, priorities, and evidence requirements; lead hands-on analysis and specialist workstreams across enterprise on-premises and cloud environments.
Contextualize and prioritize findings, correlate evidence from disparate sources, and build cohesive incident timelines; identify what is known, what remains uncertain, and what further collection or analysis is needed.
Assess adversary activity, compromise scope, and potential data collection or exfiltration; validate findings and explain the confidence and limitations of conclusions.
Direct technical response planning and recommend ways to secure enterprise environments, balancing containment and recovery urgency with evidence preservation and customer business constraints; coordinate execution with customer-authorized teams.
Serve as the primary technical point of contact for complex investigations and brief technical teams, executives, legal, compliance, engineering, and other stakeholders on objectives, findings, and decision options.
Identify skill, access, telemetry, and resource gaps; work with incident coordinators and leadership to resolve dependencies, obtain specialist support, and escalate delivery risks.
Maintain investigative documentation and follow-the-sun handovers covering evidence, hypotheses, decisions, risks, and next actions; support final reporting and lessons learned.
Share research, mentor colleagues, and help strengthen investigation capability and shape Defender Experts Cybersecurity Incident Response.