Principal Technical Program Manager - Technical Program Management, Threat Response

Overview

As a member of the Microsoft Threat Protection Security Research team, you’ll join a diverse global community of engineers, program managers, data scientists, security researchers, and threat hunters who apply deep knowledge of attacker tactics and cutting-edge technology to protect customers. We are looking for a Principal Technical Program Manager to join our Threat Response team. The Threat Response team leads Microsoft Security’s response to high-severity security incidents, coordinating research, engineering, threat intelligence, and communications teams to get validated, actionable protection guidance to customers quickly. In this role, you will act as a Crisis Manager during complex incidents, lead post-incident improvement, and help shape how AI and automation make our response faster and more effective. This is a critical role at the intersection of security research, operations, and customer protection.

Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

Responsibilities

• Incident leadership: Act as Crisis Manager for highly complex, high-severity security incidents. Create clarity in ambiguous, fast-moving situations, use sound technical judgment to set priorities, and drive fast delivery of validated, actionable protection guidance to customers.
• Take part in an on-call rotation, including occasional after-hours and weekend coverage.
• Program definition and metrics: Find highly complex gaps and opportunities across the incident response lifecycle, using incident data, response trends and post-incident findings to spot patterns. 
• Define goals, priorities, success criteria and performance metrics, such as time to declare, time to customer guidance and SLA adherence. Cross-organizational orchestration: Build relationships across program management, engineering, threat intelligence and incident response teams to coordinate response efforts, influence decisions and drive action across organizational boundaries. Give leadership clear, timely updates on incident status, impact and next steps.
• Execution and accountability: Track, coordinate and communicate end-to-end response and improvement timelines. Manage dependencies, flag risks early and hold stakeholders accountable.
• Plan and run pilots and rollouts of new processes and tools, aligned with team goals (OKRs and KPIs). 
• Engineering partnership and AI/automation: Work with engineering to design integrated tooling, automation and AI solutions for complex incident response needs, with human-in-the-loop validation and responsible AI practices.
• Help prioritize and deliver the tooling roadmap, and make the case for the capacity and resources the team needs. Governance and continuous improvement: Drive governance for incident response, including quality standards, validation gates and publication guardrails, so customer-facing guidance is accurate, safe and compliant.
• Lead post-incident reviews, check that improvements meet agreed targets, and drive changes to closure across teams. Documentation, advisory and culture: Own incident response workflows, runbooks and playbooks so responses are repeatable and scale.
• Act as a technical advisor to partner teams, help grow the skills of other Crisis Managers, and model curiosity, inclusion and accountability.

Qualifications

• Bachelor's Degree AND 6+ years experience in engineering, product/technical program management, data analysis, or product development OR equivalent experience. 

Preferred Qualifciation:

• Bachelor's Degree AND 10+ years experience in engineering, product/technical program management, data analysis, or product development OR equivalent experience.
• 8+ years of experience managing cross-functional and/or cross-team projects.
• 4+ years of experience in incident response, crisis management, or security operations. • Experience in cybersecurity or complex technical product environments.
• Experience applying AI tools, copilots, or agents to improve operational workflows, such as triage, summarization, drafting, or analysis.
• Experience working with automation systems.
• Experience building and running post-incident review programs that drive measurable improvement.
• Experience creating customer-facing security guidance, such as advisories, detection or hunting guidance, or mitigations.

Other Requirements
Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings: Microsoft Cloud Background Check:
- This position will be required to pass the Microsoft background and Microsoft Cloud background check upon hire/transfer and every two years thereafter.

Technical Program Management IC5 - The typical base pay range for this role across the U.S. is USD $142,800 - $274,800 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $188,000 - $304,200 per year.

Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
https://careers.microsoft.com/us/en/us-corporate-pay

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

---

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.