Incident Response Program Manager

About the Role

The Trust and Integrity Protection (TrIP) organization supports Microsoft’s commercial business growth through trust by managing security, privacy, data-protection, regulatory, and operational risks. The TrIP Incident Response team provides incident-response capabilities for security, privacy, and data-protection events impacting Microsoft’s commercial business. This role will offer hands-on incident coordination and program-management support within a global operating model, enhancing coverage and the team's ability to manage high-priority and concurrent incidents.

Key Responsibilities

• Protect customers and the business:
• Support timely containment of active or potential data exposure by gathering and validating facts to assess customer impact, affected data, impacted environments, geographic considerations, and potential harm.
• Coordinate with privacy, legal, security, engineering, business, and customer-facing stakeholders to evaluate regulatory, contractual, and notification requirements.
• Ensure time-sensitive requirements and internal service commitments are identified, tracked, escalated, and completed.
• Support specialized incidents involving delivery partners, restricted environments, government information, and other scenarios requiring additional handling controls.
• Coordinate incident response:
• Triage reported events to determine scope, severity, ownership, required stakeholders, and immediate response actions.
• Drive incidents through containment, investigation, remediation, notification assessment, evidence collection, and closure.
• Coordinate high-priority or non-routine incidents requiring rapid escalation, specialized engagement, or authoritative Microsoft decisions.
• Maintain clear ownership, timelines, dependencies, decisions, and next actions throughout the incident lifecycle.
• Participate in a shared on-call rotation for incident-response coverage.
• Drive disciplined case management:
• Maintain complete, accurate, and audit-ready incident records in approved case-management systems.
• Document verified facts, incident decisions, stakeholders, remediation actions, approvals, communications, evidence, and closure rationale.
• Monitor active cases, aging, escalations, blockers, response commitments, and required follow-up actions.
• Coordinate across engineering and business teams to resolve dependencies and advance incidents toward closure.
• Identify recurring incident patterns, control weaknesses, process gaps, and broader risks discovered through incident investigations.
• Translate operational findings into actionable remediation recommendations and track agreed actions to completion.
• Improve incident-response operations:
• Analyze operational data and case trends to identify opportunities for improving response quality, speed, consistency, and stakeholder experience.
• Contribute to incident-response metrics, dashboards, reporting, service reviews, and leadership updates.
• Develop and maintain runbooks, decision trees, escalation paths, templates, operating procedures, and readiness materials.
• Participate in post-incident reviews, tabletop exercises, and continuous-improvement activities.
• Ensure operational changes are introduced with defined ownership, documented controls, appropriate testing, and measurable outcomes.
• Partner with vendors and internal teams while maintaining clear Microsoft accountability for governance, exceptions, approvals, and high-risk decisions.
• Support the controlled operation and continued improvement of AI solutions and related incident-response automations.
• Build trusted partnerships:
• Establish effective working relationships with security, privacy, legal, engineering, support, business, risk, compliance, and customer-facing teams.
• Communicate incident status, risks, blockers, decisions, and required actions clearly to both technical and non-technical stakeholders.
• Facilitate structured discussions during high-pressure situations and drive stakeholders toward clear decisions and accountable actions.
• Operate effectively across global teams, cultures, organizations, and time zones.
• Handle sensitive and confidential incident information with appropriate discretion and care.

Requirements & Tech Stack

• Incident-response capabilities
• Security, privacy, and data-protection event management
• Technical program management
• Operational readiness and process improvement
• Metrics and reporting
• Post-incident learning
• Controlled use of automation technologies
• Global operating model
• On-call rotation
• Case-management systems (e.g., ServiceNow or comparable)
• AI solutions and related incident-response automations

Qualifications

• Bachelor's Degree AND 2+ years of experience in engineering, product/technical program management, data analysis, or product development OR equivalent experience.
• 1+ year(s) of experience managing cross-functional and/or cross-team projects.
• Comfortable moving between detailed case execution and broader operational improvement.
• Ability to communicate clearly with technical teams, legal and compliance partners, business leaders, and customer-facing stakeholders.
• Ability to use data and operational evidence to identify patterns and improve controls, processes, and readiness.
• Takes ownership and maintains high standards for quality, confidentiality, and auditability.
• Experience managing multiple workstreams, stakeholders, dependencies, risks, and deadlines in a complex environment.
• Ability to gather technical and business information, distinguish verified facts from assumptions, and translate findings into clear actions.
• Strong written and verbal communication skills, including the ability to document decisions, operational processes, and technical issues clearly.
• Ability to work through ambiguity, adjust priorities during active incidents, and maintain effective execution under time-sensitive conditions.
• Ability to participate in a shared on-call rotation, including support outside standard business hours when required.
• Experience coordinating incident triage, containment, investigation, remediation, evidence collection, or post-incident reviews.
• Familiarity with incident and case-management platforms such as ServiceNow, or comparable systems.
• Experience developing or improving operational procedures, runbooks, escalation paths, metrics, dashboards, and service-management processes.
• Experience partnering with engineering teams to manage defects, operational dependencies, production readiness, and automation.
• Familiarity with regulatory, contractual, customer-notification, or government-environment considerations affecting incident response.
• Experience leading AI-powered transformation initiatives, including the implementation of agentic workflows, automation, and data-driven solutions at enterprise scale.
• Ability to create structure during ambiguous, fast-moving, and high-pressure situations.