Job description

Overview With more than 45,000 employees and partners worldwide, the Customer Experience and Success (CE&S) organization is on a mission to empower customers to accelerate business value through differentiated customer experiences that leverage Microsoft products, services and partnerships. Microsoft's Detection and Response Team (DART) is seeking a skilled and experienced Cybersecurity Resilience Lead to join the team in the United States. DART is the first port of call for many customers during a security incident. This pivotal, customer-facing position designs and delivers proactive resilience offerings that help customers anticipate, withstand and recover from cybersecurity incidents. You will lead proactive resilience engagements, establish delivery priorities and act as a trusted advisor for customers, including executive stakeholders. Working with incident responders, threat hunters, infrastructure engineers, reverse engineers and operations teams, you will help customers improve readiness before an incident and strengthen durable response capability after lessons learned. As part of a globally distributed, mission-driven team, you will share practical resilience expertise, mentor colleagues and help shape the future of Defender Experts Cybersecurity Incident Response. Microsoft's mission is to empower every person and every organization on the planet to achieve more. Employees are expected to demonstrate a growth mindset, innovation, collaboration, respect, integrity, accountability and inclusion. Responsibilities As a Resilience Lead, you will orchestrate evidence-driven proactive engagements, align stakeholders and communicate clear priorities, recommendations, and readiness improvements to customers. ● Set resilience engagement objectives, customer outcomes, priorities and evidence requirements; lead proactive workstreams across enterprise on-premises and cloud environments. ● Design and deliver readiness assessments, tabletop exercises, cyber range simulations, playbook development and threat modelling engagements that improve incident response readiness. ● Translate technical and operational findings into clear priorities, risk reduction actions and executive-ready recommendations. ● Lead workshops that would include: Assess customer incident response plans, roles, escalation paths, communication models, evidence readiness and recovery dependencies; establish what is mature, what remains uncertain and what needs further validation. ● Lead customer workshops and stakeholder discussions that align technical and operational teams, executives and other core business functions around practical response improvements. ● Partner with internal resources incident response, threat hunting, infrastructure, reverse engineering, product and operations teams to improve service capabilities and offering quality. ● Use customer feedback, field insights and lessons learned to improve resilience offerings, engagement methods and DART readiness practices. ● Maintain engagement documentation covering objectives, decisions, risks, dependencies and next actions; support final reporting and lessons learned. Qualifications Required Qualifications: • Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection • OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection • OR equivalent experience. Other Requirements: • Ability to meet Microsoft, customer and / or government security screening requirements are required for this role. These requirements include but are not limited to the following specialized security screenings: Microsoft Cloud Background Check and any additional checks needed for customer or government work. Preferred Qualifications: • Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection • OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 6+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection • OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 8+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection • OR equivalent experience. • Experience in incident response, incident management, crisis management, resilience, security operations, or enterprise risk reduction. • Demonstrated experience planning, coordinating, delivering, and evaluating business resilience exercises (e.g. tabletops, cybersecurity workshops, readiness assessments, incident response plans, or operational resilience engagements) • Experience reviewing, assessing, and developing resilience related technical and operational programs/plans. Including but not limited to business continuity management, crisis management, operational resilience, technical resilience, and incident response. • Proven ability to evaluate, support understanding, and communicate improvement opportunities of the stakeholder cybersecurity related technical and operational risk landscape through consolidation of inputs, assessment of disruption risks, and communication of suggested remediation efforts. • Demonstrated ability to guide stakeholders, build agreement and translate technical issues into practical actions for teams with different levels of technical knowledge. • Experience applying cybersecurity or resilience frameworks such as NIST, MITRE ATT&CK, ISO 27001 or equivalent guidance in customer-facing work to support findings and improvement suggestions. • Customer-facing written and verbal communication, including executive briefings, facilitation and clear documentation. • Evidence of sound judgement, accurate record keeping, operational discipline and effective follow-the-sun handovers. • Flexibility to work non-standard business hours that may include evening, nighttime, weekends and/or holidays. • Experience delivering cyber range exercises, tabletop exercises, purple-team style scenarios or customer readiness programmes. • Proven track record leading or developing enterprise business continuity, crisis management, or incident response programs • Cloud security experience in hybrid environments and practical understanding of identity, endpoint, network and recovery dependencies. • Demonstrated research, process improvement, offering development or technical mentoring that strengthens resilience capability. • Certifications such as CISSP, CISM, DRI, GIAC or equivalent practical expertise. • Resilience under stress and ability to collaborate across globally distributed teams, customers and partners. Security Research IC4 - The typical base pay range for this role across the U.S. is USD $119,800 - $234,700 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $160,200 - $261,000 per year. Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here: careers.microsoft.com This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled. Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.

Requirements

Must-haves

As a Resilience Lead, you will orchestrate evidence-driven proactive engagements, align stakeholders and communicate clear priorities, recommendations, and readiness improvements to customers.
Set resilience engagement objectives, customer outcomes, priorities and evidence requirements; lead proactive workstreams across enterprise on-premises and cloud environments.
Design and deliver readiness assessments, tabletop exercises, cyber range simulations, playbook development and threat modelling engagements that improve incident response readiness.
Translate technical and operational findings into clear priorities, risk reduction actions and executive-ready recommendations.
Lead customer workshops and stakeholder discussions that align technical and operational teams, executives and other core business functions around practical response improvements.
Partner with internal resources incident response, threat hunting, infrastructure, reverse engineering, product and operations teams to improve service capabilities and offering quality.
Use customer feedback, field insights and lessons learned to improve resilience offerings, engagement methods and DART readiness practices.
Maintain engagement documentation covering objectives, decisions, risks, dependencies and next actions; support final reporting and lessons learned.
OR equivalent experience.
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

Nice-to-haves

OR equivalent experience.
Experience in incident response, incident management, crisis management, resilience, security operations, or enterprise risk reduction.
Demonstrated ability to guide stakeholders, build agreement and translate technical issues into practical actions for teams with different levels of technical knowledge.
Experience applying cybersecurity or resilience frameworks such as NIST, MITRE ATT&CK, ISO 27001 or equivalent guidance in customer-facing work to support findings and improvement suggestions.
Customer-facing written and verbal communication, including executive briefings, facilitation and clear documentation.
Evidence of sound judgement, accurate record keeping, operational discipline and effective follow-the-sun handovers.
Flexibility to work non-standard business hours that may include evening, nighttime, weekends and/or holidays.
Experience delivering cyber range exercises, tabletop exercises, purple-team style scenarios or customer readiness programmes.
Proven track record leading or developing enterprise business continuity, crisis management, or incident response programs
Cloud security experience in hybrid environments and practical understanding of identity, endpoint, network and recovery dependencies.
Demonstrated research, process improvement, offering development or technical mentoring that strengthens resilience capability.
Certifications such as CISSP, CISM, DRI, GIAC or equivalent practical expertise.

Application prep

Use the role’s language and application details while tailoring your materials.

Platform: eightfold
Effort: medium