> Markdown version of [/jobs/ext/4319500-incident-response-program-manager](https://www.wearedevelopers.com/jobs/ext/4319500-incident-response-program-manager). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Incident Response Program Manager - **Company:** Microsoft - **Location:** Seattle, WA, United States - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Data Analysis, Bioinformatics, Operational Data Store, Runbook, Servicenow - **Published:** October 14, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=e74c1714a7ed71aa ## About the Role The role will also support operational readiness, process improvement, metrics, post-incident learning, and the controlled use of automation technologies. This is a hands-on role for someone who combines security knowledge, technical program management, sound judgment, operational discipline, and the ability to work effectively through ambiguity., * Bachelor's Degree AND 2+ years experience in engineering, product/technical program management, data analysis, or product development OR equivalent experience. 1+ year(s) of experience managing cross-functional and/or cross-team projects., The candidate is a hands-on incident responder and technical program manager who: * + Is comfortable moving between detailed case execution and broader operational improvement. + Communicates clearly with technical teams, legal and compliance partners, business leaders, and customer-facing stakeholders. + Uses data and operational evidence to identify patterns and improve controls, processes, and readiness. + Takes ownership and maintains high standards for quality, confidentiality, and auditability. + Experience managing multiple workstreams, stakeholders, dependencies, risks, and deadlines in a complex environment. + Ability to gather technical and business information, distinguish verified facts from assumptions, and translate findings into clear actions. + Strong written and verbal communication skills, including the ability to document decisions, operational processes, and technical issues clearly. + Ability to work through ambiguity, adjust priorities during active incidents, and maintain effective execution under time-sensitive conditions. + Ability to participate in a shared on-call rotation, including support outside standard business hours when required. + Experience coordinating incident triage, containment, investigation, remediation, evidence collection, or post-incident reviews. + Familiarity with incident and case-management platforms such as ServiceNow, or comparable systems. + Experience developing or improving operational procedures, runbooks, escalation paths, metrics, dashboards, and service-management processes. + Experience partnering with engineering teams to manage defects, operational dependencies, production readiness, and automation. + Familiarity with regulatory, contractual, customer-notification, or government-environment considerations affecting incident response. + Has experience leading AI-powered transformation initiatives, including the implementation of agentic workflows, automation, and data-driven solutions at enterprise scale. + Creates structure during ambiguous, fast-moving, and high-pressure situations. This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled. ## Description The successful candidate will help triage, contain, investigate, document, and resolve incidents while coordinating stakeholders and ensuring actions are completed within applicable incident-response, regulatory, contractual, and customer-notification requirements., * Support timely containment of active or potential data exposure, gathering and validating facts needed to assess customer impact, affected data, impacted environments, geographic considerations, and potential harm. * Coordinate with privacy, legal, security, engineering, business, and customer-facing stakeholders to evaluate regulatory, contractual, and notification requirements. * Help ensure that time-sensitive requirements and internal service commitments are identified, tracked, escalated, and completed. * Support specialized incidents involving delivery partners, restricted environments, government information, and other scenarios that require additional handling controls. Coordinate incident response * Triage reported events to determine scope, severity, ownership, required stakeholders, and immediate response actions. * Drive incidents through containment, investigation, remediation, notification assessment, evidence collection, and closure. * Coordinate high-priority or non-routine incidents that require rapid escalation, specialized engagement, or authoritative Microsoft decisions. * Maintain clear ownership, timelines, dependencies, decisions, and next actions throughout the incident lifecycle. * Participate in a shared on-call rotation providing incident-response coverage. Drive disciplined case management * Maintain complete, accurate, and audit-ready incident records in approved case-management systems. * Document verified facts, incident decisions, stakeholders, remediation actions, approvals, communications, evidence, and closure rationale. * Monitor active cases, aging, escalations, blockers, response commitments, and required follow-up actions. * Coordinate across engineering and business teams to resolve dependencies and keep incidents progressing toward closure. * Help identify recurring incident patterns, control weaknesses, process gaps, and broader risks discovered through incident investigations. * Translate operational findings into actionable remediation recommendations and track agreed actions to completion. Improve incident-response operations * Analyze operational data and case trends to identify opportunities to improve response quality, speed, consistency, and stakeholder experience. * Contribute to incident-response metrics, dashboards, reporting, service reviews, and leadership updates. * Develop and maintain runbooks, decision trees, escalation paths, templates, operating procedures, and readiness materials. * Participate in post-incident reviews, tabletop exercises, and continuous-improvement activities. * Help ensure that operational changes are introduced with defined ownership, documented controls, appropriate testing, and measurable outcomes. * Partner with vendors and internal teams while maintaining clear Microsoft accountability for governance, exceptions, approvals, and high-risk decisions. * Support the controlled operation and continued improvement of AI solutions and related incident-response automations., * Establish effective working relationships with security, privacy, legal, engineering, support, business, risk, compliance, and customer-facing teams. * Communicate incident status, risks, blockers, decisions, and required actions clearly to both technical and non-technical stakeholders. * Facilitate structured discussions during high-pressure situations and drive stakeholders toward clear decisions and accountable actions. * Operate effectively across global teams, cultures, organizations, and time zones. * Handle sensitive and confidential incident information with appropriate discretion and care * Embody our culture and values