Principal Technical Advisor for Cybersecurity Incident Response

**Overview** With more than 45,000 employees and partners worldwide, the Customer Experience and Success (CE&S) organization is on a mission to empower customers to accelerate business value through differentiated customer experiences that leverage Microsoft’s products and services, ignited by our people and culture. We drive cross-company alignment and execution, ensuring that we consistently exceed customers’ expectations in every interaction, whether in-product, digital, or human-centered. CE&S is responsible for all up services across the company, including consulting, customer success, and support across Microsoft’s portfolio of solutions and products. Join CE&S and help us accelerate AI transformation for our customers and the world. Within CE&S, the Customer Service & Support (CSS) organization builds trust and confidence for every person and organization through delivering a seamless support experience. In CSS, we are powered by Microsoft’s AI technology to help consumers, businesses, partners, and more, resolve their issues quickly and securely, helping prevent future problems from occurring and achieving more from their Microsoft investment. The Principal Technical Advisor for Cybersecurity Incident Response is a service delivery focused subject matter expert. You will be responsible for Cybersecurity Incident Resonse Team (CIRT) support engineer staff technical readiness and process compliance. You will provide in-depth technical & subject matter expertise for cybersecurity Incident Response scenarios all while driving delivery excellence in a collaborative environment to achieve superior customer outcomes. Your primary accountability is to support staff and managers on the teams you work with. This opportunity enables and promotes career growth as a recognized technical Subject Matter Expert (SME). Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond. **Responsibilities** - Case Management (Delivery Excellence): Demonstrate expert problem-solving, case management, and customer service skills. Strategize technical triages and provide actionable feedback to key partners and stakeholders. - Managing Collaboration Activities: Handle complex escalated problems, partner with product teams to drive fixes, and identify trends in customer feedback for future product enhancements. - Process Improvement: Refine processes by partnering with senior leadership across global teams, lead efforts to improve diagnostic data logging, and facilitate communication between engineering and support teams. Serve as an early warning system and put plans in place to mitigate issues and proactively drive solutions. - Define and evolve **engagement models, capability readiness, and service delivery frameworks** for incident response. - Serve as a **recognized expert in incident response and threat investigation**, specializing in Cloud (Azure, Microsoft 365) and Windows environments; adversary behaviors, compromise analysis, and detection techniques. - Provide technical leadership in investigations requiring advanced forensic and investigative judgment under time pressure; decision-making with incomplete data and high business impact.Influence standards for **data handling, investigative rigor, and compliance** across CIRT operations. **Qualifications** **Required/minimum qualifications** - Bachelor's Degree in Information Technology (IT), Computer Science, Business Administration, Electrical Engineering, or Business Leadership AND 8+ years system development, network operations, software support, IT, consulting, or technical troubleshooting experience - OR equivalent experience. - 8+ years prior product, customer support and/or technical support experience. **Other Requirements** - **Microsoft Cloud Background Check**: - Ability to meet Microsoft, customer and / or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings: Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud Background Check upon hire / transfer and every two years thereafter. - **Citizenship & Citizenship Verification:** - This role will require access to information that is controlled for export under export control regulations, potentially under the U.S. International Traffic in Arms Regulations or Export Administration Regulations, the EU Dual Use Regulation, and/or other export control regulations.  As a condition of employment, the successful candidate will be required to provide either proof of their country of citizenship or proof of their U.S. permanent residency or other protected status (e.g., under 8 U.S.C. 1324b(a)(3)) for assessment of eligibility to access the export-controlled information. To meet this legal requirement, and as a condition of employment, the successful candidate’s citizenship will be verified with a valid passport. Lawful permanent residents, refugees, and asylees may verify status using other documents, where applicable. - This position requires verification of citizenship due to citizenship-based legal restrictions. Specifically, this position supports United States federal, state, and/or local United States government agency customers and is subject to certain citizenship-based restrictions where required or permitted by applicable law. To meet this legal requirement,and as a condition of employment, Classified as Microsoft Confidentialthe successful candidate’s citizenship will be verified with a validpassport **Additional or preferred qualifications** - Bachelor's Degree in Information Technology (IT), Computer Science, Business Administration, Electrical Engineering, or Business Leadership AND 15+ years system development, network operations, software support, IT, consulting, or technical troubleshooting experience OR equivalent experience. - 5+ years experience in Cybersecurity Incident Response - SC-900 and ISC2 CC certifications; CISSP a plus - 10+ years prior product, customer support and/or technical support experience. - AI-900 certification or AI-901 certification. - Technologies certifications for business area (e.g., M365 Technologies, Security Certifications, Azure Certifications). Technical Support Advisory IC6 - The typical base pay range for this role across the U.S. is USD $130,900 - $277,200 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $165,600 - $303,600 per year. Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here: This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled. --- Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about [**requesting accommodations.**](https://careers.microsoft.com/v2/global/en/accessibility.html)