Cybersecurity Incident Response Coordinator

With more than45,000 employeesand partners worldwide, the Customer Experience and Success (CE&S) organization is on a mission to empower customers to accelerate business value through differentiated customer experiences thatleverageMicrosoft's products and services, ignited by our people and culture. We drive cross-company alignment and execution, ensuring that we consistently exceed customers' expectations in every interaction, whether in-product, digital, or human-centered. CE&Sis responsible forall up services across the company, including consulting, customer success, and support across Microsoft's portfolio of solutions and products. Join CE&S and help us accelerate AI transformation for our customers and the world.

The MicrosoftIncident Response Team-Detectionand Response Team (DART) are seeking a skilled andexperiencedCybersecurity Incident ResponseCoordinatorto join our team-DART isthe first port of call for many customers during a security incident. Thispivotal, customer-facingposition calls for a tactical and agile leader and influencer, one who is adept at managingcomplex cybersecurity incidents, fostering synergistic teamwork acrossmultifacetedgroups and ensuring the effectivestaffingand resolution ofboth proactive and reactive deliveries.

Other Requirements:

• Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings:
  • Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud Background Check upon hire/transfer and every two years thereafter.

• Doctorate in Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
• OR Master's Degree in Computer Science, Computer Security, or related field AND 6+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
• • OR Bachelor's Degree in Computer Science, Computer Security, or related field AND 8+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
  • OR equivalent experience
• Flexibility to work shifts, including assignments during non-standard business hours that may include evening, nighttime, weekends, and/or holidays.
• 2+ years of hands-on experience with Active Directory, Entra ID, or other enterprise identity platforms and/OR 2+ years threat hunting, windows forensics OR 2+ years pentesting experience
• 1+ years ability to script or automate tasks using PowerShell or similar tools or 1+ years KQL experience
• Experience in high pressure reactive incident response environments where customers are experiencing a potentially business-ending event and your evidence-driven plans of action dictate their next steps.This skill set should include but is not limited to:
• Lead and manage high-profile incident response efforts for some of the world's largest businesses
• Coordinate and lead all key stakeholders as the primary point of contact for major incidents. This could include technical teams, executives, consultants, and partners
• Identify gaps early in the engagement process and request appropriate resources to fill those gaps
• Balance the need for rapid recovery with data collection and evidence preservation.
• Direct activities to secure Enterprise-scale environments and assess potential data exfiltration of data collection
• Management of large scale incidents in a follow-the-sun format working with fellow team members from across the globe
• Contextual application of MITRE Attack Framework and or OSI Model.
• Delivery of complex and technical discussions effectively to customer representatives of varying levels
• Security Certifications in any of the following: OSCP, CISSP, SANS Certifications, SC Certifications from Microsoft.
• Experience working with methods utilized for evidence collection, maintenance of chain of custody and associated documentation, evidence storage and analysis, and evidentiary reporting.
• Seasoned expertise in Incident Management or the Incident Response sector, with a focus on enhancing the efficacy and efficiency of incident management operations.
• Resilience under stress, coupled with a readiness to occasionally operate beyond standard business hours to assist with incidents.
• Effective interpersonal and communication abilities, conducive to productive collaboration within diverse team structures.
• Proactive approach in initiating actions and advocating for improvements to establish more streamlined and effective incident management processes