Principal Technical Program Manager

Microsoft•Redmond, WA

About The Position

As a member of Microsoft Threat Protection Security Research, the Principal Technical Program Manager joins a global team of engineers, program managers, data scientists, security researchers, and threat hunters working to protect customers. The role is on the Threat Response team, which leads Microsoft Security’s response to high-severity incidents by coordinating research, engineering, threat intelligence, and communications teams to deliver validated, actionable protection guidance to customers. The position acts as Crisis Manager during complex incidents, leads post-incident improvement, and helps shape the use of AI and automation to improve response speed and effectiveness. It operates at the intersection of security research, operations, and customer protection. The role includes participation in an on-call rotation, with occasional after-hours and weekend coverage, and requires Microsoft Cloud background screening upon hire or transfer and every two years thereafter.

Requirements

Bachelor’s degree and 6+ years of experience in engineering, product/technical program management, data analysis, or product development, or equivalent experience.
8+ years of experience managing cross-functional and/or cross-team projects.
4+ years of experience in incident response, crisis management, or security operations.
Experience in cybersecurity or complex technical product environments.
Ability to meet Microsoft, customer, and/or government security screening requirements, including the Microsoft Cloud Background Check upon hire or transfer and every two years thereafter.

Nice To Haves

Bachelor’s degree and 10+ years of experience in engineering, product/technical program management, data analysis, or product development, or equivalent experience.
Experience applying AI tools, copilots, or agents to improve operational workflows such as triage, summarization, drafting, or analysis.
Experience working with automation systems.
Experience building and running post-incident review programs that drive measurable improvement.
Experience creating customer-facing security guidance, such as advisories, detection or hunting guidance, or mitigations.

Responsibilities

Act as Crisis Manager for highly complex, high-severity security incidents; establish clarity and priorities in ambiguous, fast-moving situations and drive timely delivery of validated customer protection guidance.
Participate in an on-call rotation, including occasional after-hours and weekend coverage.
Identify complex gaps and opportunities across the incident response lifecycle using incident data, response trends, and post-incident findings.
Define program goals, priorities, success criteria, and performance metrics, including time to declare, time to customer guidance, and SLA adherence.
Build relationships across program management, engineering, threat intelligence, and incident response teams to coordinate response, influence decisions, and drive action across organizational boundaries.
Provide leadership with timely, clear updates on incident status, impact, and next steps.
Track and communicate end-to-end response and improvement timelines, manage dependencies, identify risks early, and hold stakeholders accountable.
Plan and run pilots and rollouts of new processes and tools aligned with team OKRs and KPIs.
Partner with engineering to design integrated tooling, automation, and AI solutions for incident response, using human-in-the-loop validation and responsible AI practices.
Prioritize and deliver the tooling roadmap and make the case for required team capacity and resources.
Drive incident-response governance, including quality standards, validation gates, and publication guardrails to ensure customer-facing guidance is accurate, safe, and compliant.
Lead post-incident reviews, verify improvements against agreed targets, and drive changes to closure across teams.
Own incident-response workflows, runbooks, and playbooks to make responses repeatable and scalable.
Advise partner teams, help develop other Crisis Managers, and model curiosity, inclusion, and accountability.