[Hiring] Cybersecurity Lead Investigator @Microsoft

Role Description

Microsoft's Detection and Response Team (DART) is seeking a skilled and experienced Cybersecurity Lead Investigator to join the team. DART is the first port of call for many customers during a security incident. This pivotal, customer-facing role calls for a technically deep and agile investigator who can lead complex, high-impact incident response across on-premises and cloud environments and turn incomplete evidence into clear, defensible response decisions.

• Lead the investigation, establish technical priorities, and act as the primary technical point of contact for customers, including executive stakeholders.
• Work with threat hunters, reverse engineers, infrastructure engineers, and incident coordinators to bring together investigative findings and direct response recommendations.
• Share research, mentor colleagues, and help shape the future of Defender Experts Cybersecurity Incident Response.

Responsibilities

• Orchestrate evidence-driven investigations and technical incident response.
• Align specialist workstreams and communicate clear findings, priorities, and recommendations to customers.

Technical Delivery

• Contextualize and prioritize findings to create a comprehensive account and briefing of security incidents.
• Build and communicate a cohesive timeline of activity from multiple disparate events.
• Collaborate with stakeholders at every level of the business, including legal, compliance, cybersecurity, engineering, and executive functions.
• Manage complexities of large-scale cybersecurity investigations for global multi-national organizations.

Research

• Lead research and analysis of security threats, sharing findings across the team.
• Identify and support research into critical security areas, such as current attacks and adversary tracking.
• Analyze complex issues using multiple data sources to develop insights and identify security problems.
• Recommend prioritization and validation methods for technical indicators.
• Lead efforts to clean, structure, and standardize data and data sources.

Thought Leadership

• Develop written content for publication on Microsoft blog platforms.
• Develop presentations for delivery at internal and external conferences.
• Lead by ideating, mentoring, and supporting thought leadership efforts across the team.

Operational Excellence

• Complete operational tasks and readiness with timeliness and accuracy.
• Follow Microsoft policies, compliance, and procedures.
• Guide team members on operational tasks, readiness, and compliance.

Qualifications

• Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field.
• OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in relevant fields.
• OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 4+ years experience in relevant fields.
• OR equivalent experience.

Requirements

• Verification of U.S. citizenship due to citizenship-based legal restrictions.
• Ability to meet Microsoft, customer, and/or government security screening requirements.
• Pass the Microsoft Cloud Background Check upon hire/transfer and every two years thereafter.

Preferred Qualifications

• Demonstrated hands-on experience leading large-scale, high-pressure cybersecurity incident response.
• Coordinate and lead all key stakeholders as the primary point of contact for major incidents.
• Identify gaps early in the engagement process and request appropriate resources.
• Balance the need for rapid recovery with data collection and evidence preservation.
• Contextual application of MITRE Attack Framework and/or OSI Model.
• Security Certifications in OSCP, CISSP, SANS Certifications, SC Certifications from Microsoft.
• Experience with evidence collection, maintenance of chain of custody, and evidentiary reporting.
• Eligibility to obtain or currently active government security clearance.

Benefits

• Base pay range for this role across the U.S. is USD $119,800 - $234,700 per year.
• Different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area is USD $160,200 - $261,000 per year.
• Certain roles may be eligible for additional benefits and compensation.