{"id":2574557,"url":"https://alion.io/job/microsoft-incident-response-program-manager","title":"Incident Response Program Manager","company":{"id":18,"name":"Microsoft","domain":"microsoft.com","url":"https://alion.io/company/microsoft","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Eightfold","truth_index":{"grade":"B","score":75,"open_postings":106,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-14T06:34:16Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Seattle, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":83000,"max_usd":171000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":297},"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":true},{"name":"ServiceNow","optional":true}],"status":"live","first_seen_at":"2026-10-07T15:39:16Z","employer_posted_date":"2026-10-14","last_verified_at":"2026-10-15T03:26:28Z","board_verified":true,"closed_at":null,"days_open":7,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":7},"description":"OverviewThe Trust and Integrity Protection (TrIP) organization helps Microsoft’s commercial business grow with trust by translating security, privacy, data-protection, regulatory, and operational risks into clear decisions, effective controls, and measurable outcomes.\nThe TrIP Incident Response team provides incident-response capabilities for in-scope security, privacy, and data-protection events affecting Microsoft’s commercial business. The team assesses reported events, coordinates containment and remediation, supports regulatory and customer-notification decisions, maintains incident evidence, and works with engineering, legal, privacy, security, and business stakeholders through closure.\nWe are looking for a Incident Response Program Manager to join the TrIP Security Incident Response team. This role will provide hands-on incident coordination and program-management support across a global operating model, strengthening coverage and the team’s ability to respond to high-priority and concurrent incidents.\nThe successful candidate will help triage, contain, investigate, document, and resolve incidents while coordinating stakeholders and ensuring actions are completed within applicable incident-response, regulatory, contractual, and customer-notification requirements.\nThe role will also support operational readiness, process improvement, metrics, post-incident learning, and the controlled use of automation technologies. This is a hands-on role for someone who combines security knowledge, technical program management, sound judgment, operational discipline, and the ability to work effectively through ambiguity.\nMicrosoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.\nResponsibilities\nProtect customers and the business\nSupport timely containment of active or potential data exposure, gathering and validating facts needed to assess customer impact, affected data, impacted environments, geographic considerations, and potential harm.\nCoordinate with privacy, legal, security, engineering, business, and customer-facing stakeholders to evaluate regulatory, contractual, and notification requirements.\nHelp ensure that time-sensitive requirements and internal service commitments are identified, tracked, escalated, and completed.\nSupport specialized incidents involving delivery partners, restricted environments, government information, and other scenarios that require additional handling controls.\nCoordinate incident response\nTriage reported events to determine scope, severity, ownership, required stakeholders, and immediate response actions.\nDrive incidents through containment, investigation, remediation, notification assessment, evidence collection, and closure.\nCoordinate high-priority or non-routine incidents that require rapid escalation, specialized engagement, or authoritative Microsoft decisions.\nMaintain clear ownership, timelines, dependencies, decisions, and next actions throughout the incident lifecycle.\nParticipate in a shared on-call rotation providing incident-response coverage.\nDrive disciplined case management\nMaintain complete, accurate, and audit-ready incident records in approved case-management systems.\nDocument verified facts, incident decisions, stakeholders, remediation actions, approvals, communications, evidence, and closure rationale.\nMonitor active cases, aging, escalations, blockers, response commitments, and required follow-up actions.\nCoordinate across engineering and business teams to resolve dependencies and keep incidents progressing toward closure.\nHelp identify recurring incident patterns, control weaknesses, process gaps, and broader risks discovered through incident investigations.\nTranslate operational findings into actionable remediation recommendations and track agreed actions to completion.\nImprove incident-response operations\nAnalyze operational data and case trends to identify opportunities to improve response quality, speed, consistency, and stakeholder experience.\nContribute to incident-response metrics, dashboards, reporting, service reviews, and leadership updates.\nDevelop and maintain runbooks, decision trees, escalation paths, templates, operating procedures, and readiness materials.\nParticipate in post-incident reviews, tabletop exercises, and continuous-improvement activities.\nHelp ensure that operational changes are introduced with defined ownership, documented controls, appropriate testing, and measurable outcomes.\nPartner with vendors and internal teams while maintaining clear Microsoft accountability for governance, exceptions, approvals, and high-risk decisions.\nSupport the controlled operation and continued improvement of AI solutions and related incident-response automations.\nBuild trusted partnerships\nEstablish effective working relationships with security, privacy, legal, engineering, support, business, risk, compliance, and customer-facing teams.\nCommunicate incident status, risks, blockers, decisions, and required actions clearly to both technical and non-technical stakeholders.\nFacilitate structured discussions during high-pressure situations and drive stakeholders toward clear decisions and accountable actions.\nOperate effectively across global teams, cultures, organizations, and time zones.\nHandle sensitive and confidential incident information with appropriate discretion and care\nEmbody our culture and values\nQualifications\nRequired Qualifications\nBachelor's Degree AND 2+ years experience in engineering, product/technical program management, data analysis, or product development OR equivalent experience.\n1+ year(s) of experience managing cross-functional and/or cross-team projects.\n\nPreferred Qualifications\nThe candidate is a hands-on incident responder and technical program manager who:\nIs comfortable moving between detailed case execution and broader operational improvement.\nCommunicates clearly with technical teams, legal and compliance partners, business leaders, and customer-facing stakeholders.\nUses data and operational evidence to identify patterns and improve controls, processes, and readiness.\nTakes ownership and maintains high standards for quality, confidentiality, and auditability.\nExperience managing multiple workstreams, stakeholders, dependencies, risks, and deadlines in a complex environment.\nAbility to gather technical and business information, distinguish verified facts from assumptions, and translate findings into clear actions.\nStrong written and verbal communication skills, including the ability to document decisions, operational processes, and technical issues clearly.\nAbility to work through ambiguity, adjust priorities during active incidents, and maintain effective execution under time-sensitive conditions.\nAbility to participate in a shared on-call rotation, including support outside standard business hours when required.\nExperience coordinating incident triage, containment, investigation, remediation, evidence collection, or post-incident reviews.\nFamiliarity with incident and case-management platforms such as ServiceNow, or comparable systems.\nExperience developing or improving operational procedures, runbooks, escalation paths, metrics, dashboards, and service-management processes.\nExperience partnering with engineering teams to manage defects, operational dependencies, production readiness, and automation.\nFamiliarity with regulatory, contractual, customer-notification, or government-environment considerations affecting incident response.\n Has experience leading AI-powered transformation initiatives, including the implementation of agentic workflows, automation, and data-driven solutions at enterprise scale.\nCreates structure during ambiguous, fast-moving, and high-pressure situations.\n\nThis position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.\nMicrosoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.","description_format":"text","description_chars":8927,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Console Games","Gaming Consoles","Developer Tools"],"lifecycle":[{"event":"open","at":"2026-10-14T23:39:50Z"}],"visa":[],"liveness":{"score":74,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.818,"p_room":0.9,"age_days":7,"expected_fill_days":13,"reasons":["conf:2","win:mid","comp:junior,brand"],"computed_at":"2026-10-15T05:39:24Z"},"pay":null,"html_url":"https://alion.io/job/microsoft-incident-response-program-manager","json_url":"https://alion.io/job/microsoft-incident-response-program-manager.json","meta":{"generated_at":"2026-10-15T05:39:24Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8339,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":18},"rest":"https://alion.io/mcp/rest/get_company?id=18"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmicrosoft-incident-response-program-manager"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmicrosoft-incident-response-program-manager"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmicrosoft-incident-response-program-manager"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/microsoft-incident-response-program-manager\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmicrosoft-incident-response-program-manager"}]}