Principal Technical Advisor for Cybersecurity Incident Response

Build higher-impact incident response capabilities with a role focused on delivery excellence and customer outcomes. As a service delivery-focused subject matter expert, you will provide deep incident response guidance while strengthening technical readiness, process compliance, and cross-team communication across global operations.

Responsibilities

• Apply expert problem-solving, case management, and customer service skills to strategize technical triage and deliver actionable feedback to key partners and stakeholders.
• Lead complex escalations, partner with product teams to drive fixes, and surface trends from customer feedback to support future product enhancements.
• Improve and refine processes through collaboration with senior leadership across global teams, including leading efforts to enhance diagnostic data logging and facilitating communication between engineering and support teams.
• Operate as an early warning system by putting plans in place to mitigate issues and proactively drive solutions.
• Define and evolve engagement models, capability readiness, and service delivery frameworks for incident response.
• Serve as a recognized expert in incident response and threat investigation across Cloud (Azure, Microsoft 365) and Windows, focusing on adversary behaviors, compromise analysis, and detection techniques.
• Provide technical leadership in time-sensitive investigations requiring advanced forensic and investigative judgment, making decisions with incomplete data and high business impact while influencing standards for data handling, investigative rigor, and compliance across CIRT operations.

Requirements

• Bachelor’s Degree in Information Technology (IT), Computer Science, Business Administration, Electrical Engineering, or a related field, AND 8+ years of system development, network operations, software support, IT, consulting, or technical troubleshooting experience (or equivalent experience).
• 8+ years prior product, customer support, and/or technical support experience.
• Ability to meet Microsoft, customer and/or government security screening requirements for this role, including the Microsoft Cloud Background Check, required upon hire/transfer and every two years thereafter.
• Provide proof of country of citizenship or proof of U.S. permanent residency or other protected status for eligibility to access export-controlled information. Citizenship verification is required with a valid passport.
• Role classification is Microsoft Confidential; citizenship verification will be performed with a valid passport due to citizenship-based legal restrictions.

Preferred qualifications

• Bachelor’s Degree (as listed above) AND 15+ years of related system development, network operations, software support, IT, consulting, or technical troubleshooting experience (or equivalent experience).
• 5+ years experience in Cybersecurity Incident Response.
• SC-900 and ISC2 CC certifications; CISSP is a plus.
• 10+ years prior product, customer support, and/or technical support experience.
• AI-900 certification or AI-901 certification.
• Relevant technology certifications for the business area (for example: M365 Technologies, security certifications, or Azure certifications).

Technologies

• Azure
• Microsoft 365
• Windows

Location and compensation

Location: Redmond, WA (onsite). Salary: USD 130,900 - 303,600 per year.

Typical base pay range across the U.S.: USD $130,900 - $277,200 per year. Different ranges apply to specific work locations: San Francisco Bay area and New York City metropolitan area: USD $165,600 - $303,600 per year.

Application timeline

This posting is open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.