Technical Program Manager II

Microsoft•Redmond, WA

3d•$102,100 - $219,200

About The Position

The Cyber Defense Investigations – Escalations (CDI-ESC) team is Microsoft’s deep-dive investigative arm within Cyber Defense Operations (CDO), leading complex, high-severity, and nation-state security incidents across Microsoft’s first-party cloud estate. The team brings together investigators, threat hunters, security engineers, intelligence teams, and service owners to understand and respond to sophisticated security threats. The Technical Program Manager drives programs, processes, and operational mechanisms that help CDI-ESC respond effectively at scale. Working alongside security investigators, engineering teams, and CDO partners, the role coordinates priorities, tracks complex workstreams, improves operational processes, and helps important security initiatives move from planning through execution. The position calls for developing a strong understanding of security operations, asking effective questions, bringing structure to ambiguous problems, and helping technical teams stay aligned and focused. It translates technical and operational inputs into clear plans, actions, risks, dependencies, and measurable outcomes.

Requirements

Bachelor's degree and 2+ years of experience in engineering, product or technical program management, data analysis, or product development, or equivalent experience.
Experience coordinating projects or initiatives involving multiple stakeholders, teams, or workstreams.
Ability to organize ambiguous or complex information into clear plans, actions, owners, milestones, and deliverables.
Written and verbal communication skills, including the ability to summarize technical or operational information for different audiences.
Ability to work effectively in a fast-moving environment where priorities may change in response to emerging security events.
Attention to detail and demonstrated ability to manage multiple priorities while maintaining clear communication with stakeholders.

Nice To Haves

Bachelor’s degree in Business, Computer Science, Information Technology, Cybersecurity, Engineering, or a related field and 1+ years of experience in program management, project management, security operations, engineering, data analysis, or a related technical discipline, or equivalent experience.
Familiarity with cybersecurity, incident response, security operations, threat intelligence, or cloud technologies.
Experience working with technical or engineering teams and an interest in developing deeper knowledge of cybersecurity operations.
Familiarity with program and data tools such as Azure DevOps, Power BI, Kusto/KQL, Microsoft 365, or similar platforms.
Experience using AI or Copilot-based tools to summarize information, automate workflows, analyze data, or improve team productivity.
Familiarity with operational metrics, dashboards, process improvement, or workflow automation.

Responsibilities

Coordinate security programs and operational initiatives by defining objectives, milestones, owners, dependencies, timelines, and success measures, and maintaining visibility into progress from planning through completion.
Support complex incident and investigation workstreams by coordinating activities across CDI-ESC, threat intelligence, incident coordination, containment, detection engineering, service teams, and other CDO partners.
Build and maintain program mechanisms such as roadmaps, trackers, dashboards, operating rhythms, action-item management, decision logs, and status reporting.
Drive follow-through and accountability by tracking commitments, identifying blockers and dependencies, escalating risks when appropriate, and helping ensure actions and decisions reach closure.
Improve team processes and workflows by identifying opportunities to simplify repetitive work, strengthen handoffs, document standards, automate manual processes, and make operational practices more repeatable.
Use data, telemetry, and AI-assisted tools to identify trends, measure program health, automate routine program-management activities, and improve operational decision-making.
Translate technical information into clear communications by summarizing program status, risks, dependencies, decisions, and outcomes for technical and leadership audiences.
Support retrospectives and continuous improvement by capturing lessons learned from incidents, hunts, and operational activities and tracking resulting improvements through completion.
Partner across CDO and the CISO organization to build productive working relationships, coordinate shared deliverables, and help teams stay aligned around common security objectives.