Cybersecurity Incident Response Lead

About the role

Microsoft's Detection and Response Team (DART) is looking for a Cybersecurity Lead Investigator to join its team in Singapore. DART is the first point of call for many customers during a security incident, and this customer-facing role suits someone who can lead complex, high-impact incident response across on-premises and cloud environments and turn incomplete evidence into clear, defensible decisions. You will lead investigations, set technical priorities and act as the primary technical point of contact for customers, including executive stakeholders.

Key responsibilities

• Orchestrate evidence-driven investigations, align specialist workstreams and communicate findings, priorities and recommendations to customers.
• Set investigation objectives, hypotheses, priorities and evidence requirements, and lead hands-on analysis across enterprise on-premises and cloud environments.
• Correlate evidence, build incident timelines and assess adversary activity, compromise scope and possible data exfiltration.
• Plan and recommend technical responses that balance containment and recovery with evidence preservation and business constraints, coordinating with customer-authorised teams.
• Brief technical teams, executives, legal, compliance and engineering stakeholders on objectives, findings and decision options.
• Identify skill, access, telemetry and resource gaps early, and escalate delivery risks with incident coordinators.
• Maintain follow-the-sun documentation and handovers, and support final reporting and lessons learned.

Required profile

• A degree in Computer Science, Computer Security, Statistics, Mathematics or a related field, or equivalent practical experience, plus 5+ years of industry experience.
• Demonstrated experience leading large-scale, high-pressure incident response and guiding evidence-driven customer decisions.
• Strong written and verbal communication, including executive briefings.
• Ability to work outside standard business hours, including evenings, nights, weekends and public holidays.
• Security clearance: Microsoft, customer and/or government background checks are required.

Preferred: experience with nation-state or cybercrime adversary analysis, research, automation and mentoring, and writing reviewed technical publications. Applications are accepted on an ongoing basis until the position is filled.