Cybersecurity Resilience Lead

Microsoft • ,

1d • $119,800 - $261,000

About The Position

Microsoft's Detection and Response Team (DART) is seeking a skilled and experienced Cybersecurity Resilience Lead to join its team in the United States. DART is often the first point of contact for customers during a security incident. This pivotal, customer-facing role designs and delivers proactive resilience offerings that help customers anticipate, withstand, and recover from cybersecurity incidents.

The Resilience Lead orchestrates proactive resilience engagements, establishes delivery priorities, and acts as a trusted advisor to customers, including executive stakeholders. In partnership with incident responders, threat hunters, infrastructure engineers, reverse engineers, and operations teams, the Lead helps customers improve readiness before an incident and strengthen durable response capabilities after lessons are learned.

As part of a globally distributed, mission-driven team, the Lead shares practical resilience expertise, mentors colleagues, and helps shape Defender Experts Cybersecurity Incident Response. Microsoft expects employees to demonstrate a growth mindset, innovation, collaboration, respect, integrity, accountability, and inclusion.

Requirements

• Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or a related field; or a master's degree in one of these fields and 3+ years of relevant experience; or a bachelor's degree in one of these fields and 4+ years of relevant experience; or equivalent experience.
• Relevant experience includes software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
• Ability to meet Microsoft, customer, and/or government security screening requirements, including the Microsoft Cloud Background Check and any additional checks required for customer or government work.
• Flexibility to work non-standard business hours, potentially including evenings, nights, weekends, and/or holidays.
• Resilience under stress and ability to collaborate across globally distributed teams, customers, and partners.

Nice To Haves

• Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or a related field and 3+ years of relevant experience; or a master's degree in one of these fields and 6+ years of relevant experience; or a bachelor's degree in one of these fields and 8+ years of relevant experience; or equivalent experience.
• Experience in incident response, incident management, crisis management, resilience, security operations, or enterprise risk reduction.
• Demonstrated experience planning, coordinating, delivering, and evaluating business resilience exercises, such as tabletops, cybersecurity workshops, readiness assessments, incident response plans, or operational resilience engagements.
• Experience reviewing, assessing, and developing resilience-related technical and operational programs or plans, including business continuity management, crisis management, operational resilience, technical resilience, and incident response.
• Ability to evaluate and communicate improvement opportunities in stakeholders’ cybersecurity-related technical and operational risk landscapes by consolidating inputs, assessing disruption risks, and suggesting remediation efforts.
• Demonstrated ability to guide stakeholders, build agreement, and translate technical issues into practical actions for teams with varying levels of technical knowledge.
• Experience applying cybersecurity or resilience frameworks such as NIST, MITRE ATT&CK, ISO 27001, or equivalent guidance in customer-facing work to support findings and improvement suggestions.
• Customer-facing written and verbal communication skills, including executive briefings, facilitation, and clear documentation.
• Evidence of sound judgment, accurate record keeping, operational discipline, and effective follow-the-sun handovers.
• Experience delivering cyber range exercises, tabletop exercises, purple-team-style scenarios, or customer readiness programmes.
• Track record leading or developing enterprise business continuity, crisis management, or incident response programs.
• Cloud security experience in hybrid environments and practical understanding of identity, endpoint, network, and recovery dependencies.
• Demonstrated research, process improvement, offering development, or technical mentoring that strengthens resilience capability.
• Certifications such as CISSP, CISM, DRI, GIAC, or equivalent practical expertise.

Responsibilities

• Set resilience engagement objectives, customer outcomes, priorities, and evidence requirements; lead proactive workstreams across enterprise on-premises and cloud environments.
• Design and deliver readiness assessments, tabletop exercises, cyber range simulations, playbook development, and threat modelling engagements to improve incident response readiness.
• Translate technical and operational findings into clear priorities, risk-reduction actions, and executive-ready recommendations.
• Lead workshops assessing customer incident response plans, roles, escalation paths, communication models, evidence readiness, and recovery dependencies; determine what is mature, uncertain, or requires further validation.
• Lead customer workshops and stakeholder discussions that align technical and operational teams, executives, and other core business functions around practical response improvements.
• Partner with internal incident response, threat hunting, infrastructure, reverse engineering, product, and operations teams to improve service capabilities and offering quality.
• Use customer feedback, field insights, and lessons learned to improve resilience offerings, engagement methods, and DART readiness practices.
• Maintain engagement documentation covering objectives, decisions, risks, dependencies, and next actions; support final reporting and lessons learned.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior