Cybersecurity Resilience Lead

Lead proactive resilience improvements for customers as part of Microsoft’s Detection and Response Team (DART). This United States onsite role focuses on designing resilience assessments and exercises, advising executives, and partnering across incident response and technical teams to strengthen durable response capability.

What you’ll do

• Set resilience engagement objectives, customer outcomes, priorities, and evidence requirements, then lead proactive workstreams across enterprise on-premises and cloud environments.
• Design and deliver readiness assessments and learning simulations, including tabletop exercises, cyber range activities, playbook development, and threat modeling engagements to improve incident response readiness.
• Convert technical and operational findings into risk reduction actions and executive-ready recommendations.
• Run workshops to evaluate customer incident response plans, roles, escalation paths, communication models, evidence readiness, and recovery dependencies, identifying what is mature, uncertain, and needs validation.
• Facilitate customer workshop sessions and stakeholder discussions that align technical and operational teams, executives, and other business functions around practical response improvements.
• Partner with internal teams across incident response, threat hunting, infrastructure, reverse engineering, product, and operations to improve service capabilities and offering quality.
• Incorporate customer feedback, field insights, and lessons learned to improve resilience offerings, engagement methods, and DART readiness practices.
• Maintain engagement documentation covering objectives, decisions, risks, dependencies, and next actions, supporting final reporting and lessons learned.
• Orchestrate evidence-driven proactive engagements and communicate clear priorities, recommendations, and readiness improvements to customers.

Minimum qualifications

• Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field, OR Master’s Degree in the same areas plus 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
• OR Bachelor’s Degree in the same areas plus 4+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
• OR equivalent experience.

Additional requirements

• Ability to meet Microsoft, customer and/or government security screening requirements, including the Microsoft Cloud Background Check and any additional checks needed for customer or government work.
• Experience in incident response, incident management, crisis management, resilience, security operations, or enterprise risk reduction.
• Demonstrated experience planning, coordinating, delivering, and evaluating business resilience exercises such as table-tops, cybersecurity workshops, readiness assessments, incident response plans, or operational resilience engagements.
• Experience reviewing, assessing, and developing resilience-related technical and operational programs/plans (including business continuity management, crisis management, operational resilience, technical resilience, and incident response).
• Proven ability to evaluate and communicate improvement opportunities across stakeholder cybersecurity technical and operational risk, including consolidation of inputs, disruption risk assessment, and recommended remediation efforts.
• Ability to guide stakeholders, build agreement, and translate technical issues into practical actions for teams with different technical knowledge levels.
• Experience applying cybersecurity or resilience frameworks such as NIST, MITRE ATT&CK, ISO 27001, or equivalent guidance in customer-facing work.
• Customer-facing written and verbal communication, including executive briefings, facilitation, and clear documentation.
• Sound judgment, accurate record keeping, operational discipline, and effective follow-the-sun handovers.
• Flexibility to work non-standard business hours, potentially including evenings, nighttime, weekends, and/or holidays.
• Experience delivering cyber range exercises, tabletop exercises, purple-team style scenarios, or customer readiness programmes.
• Track record leading or developing enterprise business continuity, crisis management, or incident response programs.
• Cloud security experience in hybrid environments, with practical understanding of identity, endpoint, network, and recovery dependencies.
• Research, process improvement, offering development, or technical mentoring experience that strengthens resilience capability.
• Certifications such as CISSP, CISM, DRI, GIAC, or equivalent practical expertise.
• Resilience under stress and ability to collaborate across globally distributed teams, customers, and partners.

Pay and benefits

Salary: USD 119,800 - 261,000 per year (base pay range across the U.S. is USD 119,800 - 234,700 per year).

There is a different range for specific work locations: San Francisco Bay area and New York City metropolitan area (base pay range USD 160,200 - 261,000 per year).

Certain roles may be eligible for benefits and other compensation. Find additional information here: https://careers.microsoft.com/us/en/us-corporate-pay.