Incident Response Program Manager

Microsoft•Seattle, WA

17h

About The Position

The Incident Response Program Manager joins Microsoft’s Trust and Integrity Protection (TrIP) Security Incident Response team. The team provides response capabilities for in-scope security, privacy, and data-protection events affecting Microsoft’s commercial business. This hands-on role provides incident coordination and program-management support across a global operating model, helping strengthen coverage and response to high-priority and concurrent incidents. The role helps triage, contain, investigate, document, and resolve incidents while coordinating stakeholders and ensuring actions are completed in accordance with applicable incident-response, regulatory, contractual, and customer-notification requirements. The position also supports operational readiness, process improvement, metrics, post-incident learning, and the controlled use of automation technologies. It calls for security knowledge, technical program-management skills, sound judgment, operational discipline, and the ability to work effectively through ambiguity. The role participates in a shared on-call rotation, including support outside standard business hours when required.

Requirements

Bachelor’s degree and 2+ years of experience in engineering, product/technical program management, data analysis, or product development, or equivalent experience.
At least 1 year of experience managing cross-functional and/or cross-team projects.

Nice To Haves

Experience managing multiple workstreams, stakeholders, dependencies, risks, and deadlines in a complex environment.
Ability to gather technical and business information, distinguish verified facts from assumptions, and translate findings into clear actions.
Strong written and verbal communication skills, including the ability to document decisions, operational processes, and technical issues clearly.
Ability to work through ambiguity, adjust priorities during active incidents, and maintain effective execution under time-sensitive conditions.
Ability to participate in a shared on-call rotation, including support outside standard business hours when required.
Experience coordinating incident triage, containment, investigation, remediation, evidence collection, or post-incident reviews.
Familiarity with incident and case-management platforms such as ServiceNow or comparable systems.
Experience developing or improving operational procedures, runbooks, escalation paths, metrics, dashboards, and service-management processes.
Experience partnering with engineering teams to manage defects, operational dependencies, production readiness, and automation.
Familiarity with regulatory, contractual, customer-notification, or government-environment considerations affecting incident response.
Experience leading AI-powered transformation initiatives, including implementing agentic workflows, automation, and data-driven solutions at enterprise scale.
Ability to create structure during ambiguous, fast-moving, and high-pressure situations.

Responsibilities

Support timely containment of active or potential data exposure and gather and validate facts to assess customer impact, affected data, impacted environments, geographic considerations, and potential harm.
Coordinate with privacy, legal, security, engineering, business, and customer-facing stakeholders to evaluate regulatory, contractual, and notification requirements.
Identify, track, escalate, and complete time-sensitive requirements and internal service commitments.
Support specialized incidents involving delivery partners, restricted environments, government information, and other scenarios requiring additional handling controls.
Triage reported events to determine scope, severity, ownership, required stakeholders, and immediate response actions.
Drive incidents through containment, investigation, remediation, notification assessment, evidence collection, and closure.
Coordinate high-priority or non-routine incidents requiring rapid escalation, specialized engagement, or authoritative Microsoft decisions.
Maintain clear ownership, timelines, dependencies, decisions, and next actions throughout the incident lifecycle.
Participate in a shared on-call rotation providing incident-response coverage.
Maintain complete, accurate, and audit-ready incident records in approved case-management systems, documenting verified facts, decisions, stakeholders, remediation actions, approvals, communications, evidence, and closure rationale.
Monitor active cases, aging, escalations, blockers, response commitments, and required follow-up actions.
Coordinate across engineering and business teams to resolve dependencies and progress incidents toward closure.
Identify recurring incident patterns, control weaknesses, process gaps, and broader risks discovered through investigations; translate findings into remediation recommendations and track agreed actions to completion.
Analyze operational data and case trends to improve response quality, speed, consistency, and stakeholder experience.
Contribute to incident-response metrics, dashboards, reporting, service reviews, and leadership updates.
Develop and maintain runbooks, decision trees, escalation paths, templates, operating procedures, and readiness materials.
Participate in post-incident reviews, tabletop exercises, and continuous-improvement activities.
Help introduce operational changes with defined ownership, documented controls, appropriate testing, and measurable outcomes.
Partner with vendors and internal teams while maintaining clear Microsoft accountability for governance, exceptions, approvals, and high-risk decisions.
Support the controlled operation and continued improvement of AI solutions and related incident-response automations.
Build effective working relationships with security, privacy, legal, engineering, support, business, risk, compliance, and customer-facing teams.
Communicate incident status, risks, blockers, decisions, and required actions clearly to technical and non-technical stakeholders.
Facilitate structured discussions during high-pressure situations and drive stakeholders toward clear decisions and accountable actions.
Operate effectively across global teams, cultures, organizations, and time zones.
Handle sensitive and confidential incident information with appropriate discretion and care.
Embody Microsoft’s culture and values.