← All roles

Cybersecurity Incident Response Lead

Microsoft· Security Research
Apply on company site
Singaporefull-timePosted 1w ago

About the role

Lead Investigator for Microsoft's Detection and Response Team (DART) in Singapore, responsible for orchestrating high-impact incident response across on-premises and cloud environments, coordinating with threat hunters, engineers and incident coordinators, and delivering clear, defensible response decisions to customers and executives.

Responsibilities

  • Set investigation objectives, hypotheses, priorities and evidence requirements; lead hands-on analysis and specialist workstreams across enterprise on-premises and cloud environments.
  • Contextualise and prioritise findings, correlate disparate evidence and build cohesive incident timelines. Establish what is known, what remains uncertain and what additional collection or analysis is needed.
  • Assess adversary activity, compromise scope and potential data collection or exfiltration; validate key findings and explain the confidence and limitations of conclusions.
  • Direct technical response planning and recommendations to secure enterprise environments, balancing containment and recovery urgency with evidence preservation and customer business constraints. Coordinate execution with customer-authorised teams and relevant specialists.
  • Serve as the primary technical point of contact for complex investigations; brief technical teams, executives, legal, compliance, engineering and other stakeholders with clear objectives, findings and decision options.
  • Identify skill, access, telemetry and resource gaps early; work with incident coordinators and leadership to resolve dependencies, obtain specialist support and escalate delivery risks.
  • Maintain investigative documentation and clear follow-the-sun handovers covering evidence, hypotheses, decisions, risks and next actions; support final reporting and lessons learned.

Qualifications

  • A relevant degree in Computer Science, Computer Security, Statistics, Mathematics or a related field, or equivalent practical experience in cybersecurity, incident management or related operations, AND 5+ years of industry experience.
  • Demonstrated hands-on experience leading large-scale, high-pressure cybersecurity incident response across on-premises and cloud environments, including setting investigation direction and guiding evidence-driven customer decisions.
  • Ability to correlate and assess evidence from multiple sources, reconstruct incident timelines, evaluate compromise scope and possible exfiltration, and clearly explain findings and uncertainty.
  • Experience directing response activities while balancing rapid recovery, technical dependencies and business impact.
  • Demonstrated ability to lead technical specialists and stakeholders, identify engagement gaps, request appropriate resources and manage investigations using a global follow-the-sun model.
  • Strong customer-facing written and verbal communication, including executive briefings.
  • Ability to occasionally work outside standard business hours, including evenings, nights, weekends and public holidays, based on business needs.

Skills

Required:Incident response leadershipEvidence correlation and timeline reconstructionExcellent communication (executive briefings)

Benefits

  • Microsoft equal opportunity employer
  • Flexible accommodations available during the application process
Last updated Oct 16, 2026. Interested? Apply on the company site.

About Microsoft

Cloud ComputingConsumer ElectronicsSoftwareTechnologyliquid-ai-recruiting-target
Company profileWebsite

More open roles at Microsoft