← All roles

Cybersecurity Lead Investigator

Microsoft· Security Research
Apply on company site
Hybrid (Australia)unknownPosted 2w ago

About the role

Microsoft DART is seeking a Cybersecurity Lead Investigator in Australia to lead complex incident response across on-premises and cloud environments, acting as the primary technical contact for customers and coordinating with threat hunters, reverse engineers, and incident coordinators.

Responsibilities

  • Set investigation objectives, hypotheses, priorities and evidence requirements; lead hands-on analysis and specialist workstreams across enterprise on-premises and cloud environments.
  • Contextualise and prioritise findings, correlate disparate evidence and build cohesive incident timelines. Establish what is known, what remains uncertain and what additional collection or analysis is needed.
  • Assess adversary activity, compromise scope and potential data collection or exfiltration; validate key findings and explain the confidence and limitations of conclusions.
  • Direct technical response planning and recommendations to secure enterprise environments, balancing containment and recovery urgency with evidence preservation and customer business constraints. Coordinate execution with customer-authorised teams and relevant specialists.
  • Serve as the primary technical point of contact for complex investigations; brief technical teams, executives, legal, compliance, engineering and other stakeholders with clear objectives, findings and decision options.
  • Identify skill, access, telemetry and resource gaps early; work with incident coordinators and leadership to resolve dependencies, obtain specialist support and escalate delivery risks.
  • Maintain investigative documentation and clear follow-the-sun handovers covering evidence, hypotheses, decisions, risks and next actions; support final reporting and lessons learned.

Qualifications

  • A relevant degree in Computer Science, Computer Security, Statistics, Mathematics or a related field, or equivalent practical experience in cybersecurity, incident management or related operations, AND 5+ years of industry experience.
  • Hands-on experience leading large-scale, high-pressure cybersecurity incident response across on-premises and cloud environments.
  • Ability to correlate and assess evidence from multiple sources, reconstruct incident timelines, evaluate compromise scope and possible exfiltration, and clearly explain findings and uncertainty.
  • Experience directing response activities while balancing rapid recovery, technical dependencies and business impact.
  • Demonstrated ability to lead technical specialists and stakeholders, identify engagement gaps, request appropriate resources and manage investigations using a global follow-the-sun model.
  • Demonstrable customer-facing written and verbal communication, including executive briefings.
  • Flexibility to work non-standard business hours.

Skills

Required:Investigation leadershipEvidence analysis

Benefits

  • not specified in description
Last updated Oct 9, 2026. Interested? Apply on the company site.

About Microsoft

Cloud ComputingConsumer ElectronicsSoftwareTechnologyliquid-ai-recruiting-target
Company profileWebsite

More open roles at Microsoft