Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 8 hours agoWe saw it 10 min after it went up

Incident Response Program Manager

Microsoft750 open roles

Where
Seattle, WA, United States
Work mode
On site
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowIncident Response Program ManagerMicrosoft · Seattle, WA, United States

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Microsoft's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

9.8% of postings close within 7 days. Measured by our own scanner across the market. Microsoft postings stay open a median of 19 days.

Share of postings closed within
  1. 1.9%1 day
  2. 3.9%3 days
  3. 9.8%7 days
  4. 15.5%14 days
  5. 33.7%30 days
This job: posted 8 hours ago

Microsoft median: 19 days open

The posting

Overview

The Trust and Integrity Protection (TrIP) organization helps Microsoft’s commercial business grow with trust by translating security, privacy, data-protection, regulatory, and operational risks into clear decisions, effective controls, and measurable outcomes.

The TrIP Incident Response team provides incident-response capabilities for in-scope security, privacy, and data-protection events affecting Microsoft’s commercial business. The team assesses reported events, coordinates containment and remediation, supports regulatory and customer-notification decisions, maintains incident evidence, and works with engineering, legal, privacy, security, and business stakeholders through closure.

We are looking for a Incident Response Program Manager to join the TrIP Security Incident Response team. This role will provide hands-on incident coordination and program-management support across a global operating model, strengthening coverage and the team’s ability to respond to high-priority and concurrent incidents.

The successful candidate will help triage, contain, investigate, document, and resolve incidents while coordinating stakeholders and ensuring actions are completed within applicable incident-response, regulatory, contractual, and customer-notification requirements.

The role will also support operational readiness, process improvement, metrics, post-incident learning, and the controlled use of automation technologies. This is a hands-on role for someone who combines security knowledge, technical program management, sound judgment, operational discipline, and the ability to work effectively through ambiguity.

Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

Responsibilities

Protect customers and the business

  • Support timely containment of active or potential data exposure, gathering and validating facts needed to assess customer impact, affected data, impacted environments, geographic considerations, and potential harm.
  • Coordinate with privacy, legal, security, engineering, business, and customer-facing stakeholders to evaluate regulatory, contractual, and notification requirements.
  • Help ensure that time-sensitive requirements and internal service commitments are identified, tracked, escalated, and completed.
  • Support specialized incidents involving delivery partners, restricted environments, government information, and other scenarios that require additional handling controls.

Coordinate incident response

  • Triage reported events to determine scope, severity, ownership, required stakeholders, and immediate response actions.
  • Drive incidents through containment, investigation, remediation, notification assessment, evidence collection, and closure.
  • Coordinate high-priority or non-routine incidents that require rapid escalation, specialized engagement, or authoritative Microsoft decisions.
  • Maintain clear ownership, timelines, dependencies, decisions, and next actions throughout the incident lifecycle.
  • Participate in a shared on-call rotation providing incident-response coverage.

Drive disciplined case management

  • Maintain complete, accurate, and audit-ready incident records in approved case-management systems.
  • Document verified facts, incident decisions, stakeholders, remediation actions, approvals, communications, evidence, and closure rationale.
  • Monitor active cases, aging, escalations, blockers, response commitments, and required follow-up actions.
  • Coordinate across engineering and business teams to resolve dependencies and keep incidents progressing toward closure.
  • Help identify recurring incident patterns, control weaknesses, process gaps, and broader risks discovered through incident investigations.
  • Translate operational findings into actionable remediation recommendations and track agreed actions to completion.

Improve incident-response operations

  • Analyze operational data and case trends to identify opportunities to improve response quality, speed, consistency, and stakeholder experience.
  • Contribute to incident-response metrics, dashboards, reporting, service reviews, and leadership updates.
  • Develop and maintain runbooks, decision trees, escalation paths, templates, operating procedures, and readiness materials.
  • Participate in post-incident reviews, tabletop exercises, and continuous-improvement activities.
  • Help ensure that operational changes are introduced with defined ownership, documented controls, appropriate testing, and measurable outcomes.
  • Partner with vendors and internal teams while maintaining clear Microsoft accountability for governance, exceptions, approvals, and high-risk decisions.
  • Support the controlled operation and continued improvement of AI solutions and related incident-response automations.

Build trusted partnerships

  • Establish effective working relationships with security, privacy, legal, engineering, support, business, risk, compliance, and customer-facing teams.
  • Communicate incident status, risks, blockers, decisions, and required actions clearly to both technical and non-technical stakeholders.
  • Facilitate structured discussions during high-pressure situations and drive stakeholders toward clear decisions and accountable actions.
  • Operate effectively across global teams, cultures, organizations, and time zones.
  • Handle sensitive and confidential incident information with appropriate discretion and care
  • Embody our culture and values

Qualifications

Required Qualifications

  • Bachelor's Degree AND 2+ years experience in engineering, product/technical program management, data analysis, or product development OR equivalent experience. 1+ year(s) of experience managing cross-functional and/or cross-team projects.

Preferred Qualifications

The candidate is a hands-on incident responder and technical program manager who:

  • Is comfortable moving between detailed case execution and broader operational improvement. Communicates clearly with technical teams, legal and compliance partners, business leaders, and customer-facing stakeholders. Uses data and operational evidence to identify patterns and improve controls, processes, and readiness. Takes ownership and maintains high standards for quality, confidentiality, and auditability. Experience managing multiple workstreams, stakeholders, dependencies, risks, and deadlines in a complex environment. Ability to gather technical and business information, distinguish verified facts from assumptions, and translate findings into clear actions. Strong written and verbal communication skills, including the ability to document decisions, operational processes, and technical issues clearly. Ability to work through ambiguity, adjust priorities during active incidents, and maintain effective execution under time-sensitive conditions. Ability to participate in a shared on-call rotation, including support outside standard business hours when required. Experience coordinating incident triage, containment, investigation, remediation, evidence collection, or post-incident reviews. Familiarity with incident and case-management platforms such as ServiceNow, or comparable systems. Experience developing or improving operational procedures, runbooks, escalation paths, metrics, dashboards, and service-management processes. Experience partnering with engineering teams to manage defects, operational dependencies, production readiness, and automation. Familiarity with regulatory, contractual, customer-notification, or government-environment considerations affecting incident response. Has experience leading AI-powered transformation initiatives, including the implementation of agentic workflows, automation, and data-driven solutions at enterprise scale. Creates structure during ambiguous, fast-moving, and high-pressure situations.

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Microsoft's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Microsoft's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Microsoft's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.