Incident Command & Threat Hunting Operations Manager

Microsoft • Redmond, WA

5d • $119,800 - $261,000

About The Position

The Incident Command & Threat Hunting Operations Manager is responsible for leading end-to-end incident response governance and proactive threat detection across Fraud & Abuse Security operations. This role ensures rapid, coordinated response to high-severity incidents while driving threat hunting programs that identify and disrupt adversarial activity before impact.
The role operates at the intersection of incident command, threat intelligence, and operational execution, delivering measurable reduction in customer and Microsoft harm through structured processes, data-driven decision-making, and cross-organizational coordination.

Requirements

• Doctorate in Statistics, Mathematics, Computer Science, or related field OR Master's Degree in Statistics, Mathematics, Computer Science, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat modeling, cyber security, anomaly detection, Security Operations Center (SOC) detection, threat analytics, security incident and event management (SIEM), information technology (IT), or operations incident response
• OR Bachelor's Degree in Statistics, Mathematics, Computer Science, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat modeling, cyber security, anomaly detection, Security Operations Center (SOC) detection, threat analytics, security incident and event management (SIEM), information technology (IT), or operations incident response
• OR equivalent experience.

Nice To Haves

• Master's Degree in Statistics, Mathematics, Computer Science, or related field AND 6+ years experience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detection
• OR Bachelor's Degree in Statistics, Mathematics, Computer Science, or related field AND 8+ years experience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detection
• OR equivalent experience.
• 1+ year(s) people management and/or team leadership experience, including leading security functions (e.g., SOC, TVM) and multi-disciplinary teams.
• Relevant certifications preferred (CISSP, CISA, CISM, SANS, OSCP, Security+).
• Experience in incident response, incident command, threat hunting/detection, and Security Operations (SOC/SecOps).
• Experience managing high-severity incidents and crisis response at scale.
• Understanding of adversary tactics, techniques, and procedures (TTPs), threat intelligence integration, and incident management frameworks (e.g., MFIRP, ICS).
• Experience leading cross-functional teams in complex environments and fraud/abuse ecosystems (e.g., Azure, M365, Partner Center).
• Familiarity with Kusto, telemetry analysis, ServiceNow or similar case management platforms, and detection engineering/automation pipelines.
• Experience building operational frameworks, RACI models, and governance structures.

Responsibilities

• Own and evolve the Major Incident governance model, including severity definitions, escalation pathways, and decision authority
• Act as incident command authority for high-severity (Sev A / Sev 1) or systemic incidents
• Coordinate cross-functional response across engineering, fraud, security, and product teams
• Ensure incidents are driven to resolution with clear ownership, timelines, and accountability
• Oversee incident classification, severity validation, and escalation consistency
• Sponsor and drive post-incident reviews (PIRs) to address root cause and systemic gaps
• Lead and develop a team of Major Incident Leads (MILs) or equivalent responders
• Assign and support leadership coverage across incidents and priority workstreams
• Coach incident leads on command and control execution, prioritization and trade-off decisions, and stakeholder alignment and communication
• Step in to stabilize incidents that stall, escalate improperly, or degrade in quality
• Define and operationalize threat hunting strategy and standards across Fraud Ops ecosystems
• Lead proactive hunts targeting undetected adversary activity, fraud patterns and abuse campaigns, and emerging attack techniques and TTPs
• Ensure hunts are hypothesis-driven, intelligence-informed, and measurable
• Drive integration of threat intelligence, telemetry, and analytics into hunting workflows
• Lead and develop a team of Threat Hunt Leads (THLs) or equivalent responders
• Assign and support leadership coverage across Hunts and priority workstreams
• Coach incident leads on Threat Hunt execution, prioritization and trade-off decisions, and stakeholder alignment and communication
• Step in to stabilize Hunts that stall, escalate improperly, or degrade in quality
• Ensure seamless integration between reactive incident response, proactive threat hunting, and detection engineering and automation
• Translate incident learnings into new detections, hunting hypotheses, and process and tooling improvements
• Drive closed-loop improvement model across incidents and hunts
• Serve as a central coordination point across Fraud Operations, Cyber Defense Operations, Engineering and product teams, and Threat intelligence and detection teams
• Mobilize appropriate stakeholders during incidents and threat hunts
• Ensure consistent execution across distributed teams and geographies
• Define and track key performance indicators: Time to detect (TTD), Time to mitigate (TTM), Incident containment effectiveness, Threat hunting yield and impact
• Establish audit-ready processes and documentation standards
• Drive continuous improvement across incident lifecycle management, threat detection effectiveness, and operational efficiency
• Align operations to Fraud-first principles and financial harm reduction
• Ensure policy alignment, compliance, and enforcement consistency
• Define operational strategies for risk prioritization, resource allocation, and capability development (automation, tooling, analytics)
• Influence roadmap for incident response and threat hunting capabilities

Benefits

• Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here: https://careers.microsoft.com/us/en/us-corporate-pay

What This Job Offers

• Job Type: Full-time
• Career Level: Senior