Incident Response Program Manager

The successful candidate will help triage, contain, investigate, document, and resolve incidents while coordinating stakeholders and ensuring actions are completed within applicable incident-response, regulatory, contractual, and customer-notification requirements., * Support timely containment of active or potential data exposure, gathering and validating facts needed to assess customer impact, affected data, impacted environments, geographic considerations, and potential harm.

• Coordinate with privacy, legal, security, engineering, business, and customer-facing stakeholders to evaluate regulatory, contractual, and notification requirements.
• Help ensure that time-sensitive requirements and internal service commitments are identified, tracked, escalated, and completed.
• Support specialized incidents involving delivery partners, restricted environments, government information, and other scenarios that require additional handling controls.

Coordinate incident response

• Triage reported events to determine scope, severity, ownership, required stakeholders, and immediate response actions.
• Drive incidents through containment, investigation, remediation, notification assessment, evidence collection, and closure.
• Coordinate high-priority or non-routine incidents that require rapid escalation, specialized engagement, or authoritative Microsoft decisions.
• Maintain clear ownership, timelines, dependencies, decisions, and next actions throughout the incident lifecycle.
• Participate in a shared on-call rotation providing incident-response coverage.

Drive disciplined case management

• Maintain complete, accurate, and audit-ready incident records in approved case-management systems.
• Document verified facts, incident decisions, stakeholders, remediation actions, approvals, communications, evidence, and closure rationale.
• Monitor active cases, aging, escalations, blockers, response commitments, and required follow-up actions.
• Coordinate across engineering and business teams to resolve dependencies and keep incidents progressing toward closure.
• Help identify recurring incident patterns, control weaknesses, process gaps, and broader risks discovered through incident investigations.
• Translate operational findings into actionable remediation recommendations and track agreed actions to completion.

Improve incident-response operations

• Analyze operational data and case trends to identify opportunities to improve response quality, speed, consistency, and stakeholder experience.
• Contribute to incident-response metrics, dashboards, reporting, service reviews, and leadership updates.
• Develop and maintain runbooks, decision trees, escalation paths, templates, operating procedures, and readiness materials.
• Participate in post-incident reviews, tabletop exercises, and continuous-improvement activities.
• Help ensure that operational changes are introduced with defined ownership, documented controls, appropriate testing, and measurable outcomes.
• Partner with vendors and internal teams while maintaining clear Microsoft accountability for governance, exceptions, approvals, and high-risk decisions.
• Support the controlled operation and continued improvement of AI solutions and related incident-response automations., * Establish effective working relationships with security, privacy, legal, engineering, support, business, risk, compliance, and customer-facing teams.
• Communicate incident status, risks, blockers, decisions, and required actions clearly to both technical and non-technical stakeholders.
• Facilitate structured discussions during high-pressure situations and drive stakeholders toward clear decisions and accountable actions.
• Operate effectively across global teams, cultures, organizations, and time zones.
• Handle sensitive and confidential incident information with appropriate discretion and care
• Embody our culture and values

The role will also support operational readiness, process improvement, metrics, post-incident learning, and the controlled use of automation technologies. This is a hands-on role for someone who combines security knowledge, technical program management, sound judgment, operational discipline, and the ability to work effectively through ambiguity., * Bachelor’s Degree AND 2+ years experience in engineering, product/technical program management, data analysis, or product development OR equivalent experience. 1+ year(s) of experience managing cross-functional and/or cross-team projects., The candidate is a hands-on incident responder and technical program manager who: *

• Is comfortable moving between detailed case execution and broader operational improvement.
• Communicates clearly with technical teams, legal and compliance partners, business leaders, and customer-facing stakeholders.
• Uses data and operational evidence to identify patterns and improve controls, processes, and readiness.
• Takes ownership and maintains high standards for quality, confidentiality, and auditability.
• Experience managing multiple workstreams, stakeholders, dependencies, risks, and deadlines in a complex environment.
• Ability to gather technical and business information, distinguish verified facts from assumptions, and translate findings into clear actions.
• Strong written and verbal communication skills, including the ability to document decisions, operational processes, and technical issues clearly.
• Ability to work through ambiguity, adjust priorities during active incidents, and maintain effective execution under time-sensitive conditions.
• Ability to participate in a shared on-call rotation, including support outside standard business hours when required.
• Experience coordinating incident triage, containment, investigation, remediation, evidence collection, or post-incident reviews.
• Familiarity with incident and case-management platforms such as ServiceNow, or comparable systems.
• Experience developing or improving operational procedures, runbooks, escalation paths, metrics, dashboards, and service-management processes.
• Experience partnering with engineering teams to manage defects, operational dependencies, production readiness, and automation.
• Familiarity with regulatory, contractual, customer-notification, or government-environment considerations affecting incident response.
• Has experience leading AI-powered transformation initiatives, including the implementation of agentic workflows, automation, and data-driven solutions at enterprise scale.
• Creates structure during ambiguous, fast-moving, and high-pressure situations.

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.