Incident Response Program Manager
Microsoft· Technical Program Management
full-timePosted 1w ago
About the role
The TrIP Incident Response team provides incident-response capabilities for in-scope security, privacy, and data-protection events affecting Microsoft’s commercial business. This role provides hands-on incident coordination and program-management support across a global operating model, strengthening coverage and the team’s ability to respond to high-priority and concurrent incidents, while supporting operational readiness, process improvement, metrics, post-incident learning, and controlled automation use.
Responsibilities
- Protect customers and the business: Support timely containment of active or potential data exposure, gathering and validating facts needed to assess customer impact, affected data, impacted environments, geographic considerations, and potential harm.
- Coordinate incident response: Triage reported events to determine scope, severity, ownership, required stakeholders, and immediate response actions; Drive incidents through containment, investigation, remediation, notification assessment, evidence collection, and closure; Coordinate high-priority or non-routine incidents that require rapid escalation, specialized engagement, or authoritative Microsoft decisions; Maintain clear ownership, timelines, dependencies, decisions, and next actions throughout the incident lifecycle; Participate in a shared on-call rotation providing incident-response coverage.
- Drive disciplined case management: Maintain complete, accurate, and audit-ready incident records in approved case-management systems; Document verified facts, incident decisions, stakeholders, remediation actions, approvals, communications, evidence, and closure rationale; Monitor active cases, aging, escalations, blockers, response commitments, and required follow-up actions; Coordinate across engineering and business teams to resolve dependencies and keep incidents progressing toward closure; Help identify recurring incident patterns, control weaknesses, process gaps, and broader risks discovered through incident investigations; Translate operational findings into actionable remediation recommendations and track agreed actions to completion.
- Improve incident-response operations: Analyze operational data and case trends to identify opportunities to improve response quality, speed, consistency, and stakeholder experience; Contribute to incident-response metrics, dashboards, reporting, service reviews, and leadership updates; Develop and maintain runbooks, decision trees, escalation paths, templates, operating procedures, and readiness materials; Participate in post-incident reviews, tabletop exercises, and continuous-improvement activities; Help ensure that operational changes are introduced with defined ownership, documented controls, appropriate testing, and measurable outcomes; Partner with vendors and internal teams while maintaining clear Microsoft accountability for governance, exceptions, approvals, and high-risk decisions; Support the controlled operation and continued improvement of AI solutions and related incident-response automations.
- Build trusted partnerships: Establish effective working relationships with security, privacy, legal, engineering, support, business, risk, compliance, and customer-facing teams; Communicate incident status, risks, blockers, decisions, and required actions clearly to both technical and non-technical stakeholders; Facilitate structured discussions during high-pressure situations and drive stakeholders toward clear decisions and accountable actions; Operate effectively across global teams, cultures, organizations, and time zones; Handle sensitive and confidential incident information with appropriate discretion and care
- Responsible_values_note_from_description":"Embody our culture and values"],
- qualifications=[{
Last updated Oct 16, 2026. Interested? Apply on the company site.
About Microsoft
Cloud ComputingConsumer ElectronicsSoftwareTechnologyliquid-ai-recruiting-target
More open roles at Microsoft
- Senior Security Sales Specialist4d agoHybrid (Auckland) · Digital Solution Area Specialists
- Technical Program Manager4d agoRedmond, WA, Multiple Locations · Technical Program Management
- AI Business Solutions Specialist Manager - M365 Copilot / Agents / Dynamics 365 / Power Platform4d agoTokyo · Solution Area Specialists
- Senior Technical Program Manager4d agoRedmond, WA, Hybrid (Multiple Locations) · Technical Program Management
- Senior Subsea Project & Operations Manager4d agoTokyo, Japan · Sourcing Engineering