Cybersecurity Resilience Lead

With more than 45,000 employees and partners worldwide, the Customer Experience and Success (CE&S) organization is on a mission to empower customers to accelerate business value through differentiated customer experiences that leverage Microsoft products, services and partnerships.
Microsoft's Detection and Response Team (DART) is seeking a skilled and experienced Cybersecurity Resilience Lead to join the team in Australia. DART is the first port of call for many customers during a security incident. This pivotal, customer-facing position designs and delivers proactive resilience offerings that help customers anticipate, withstand and recover from cybersecurity incidents.

You will lead proactive resilience engagements, establish delivery priorities and act as a trusted advisor for customers, including executive stakeholders. Working with incident responders, threat hunters, infrastructure engineers, reverse engineers and operations teams, you will help customers improve readiness before an incident and strengthen durable response capability after lessons learned.

As part of a globally distributed, mission-driven team, you will share practical resilience expertise, mentor colleagues and help shape the future of Defender Experts Cybersecurity Incident Response. Microsoft's mission is to empower every person and every organization on the planet to achieve more. Employees are expected to demonstrate a growth mindset, innovation, collaboration, respect, integrity, accountability and inclusion.

As a Resilience Lead, you will orchestrate evidence-driven proactive engagements, align stakeholders and communicate clear priorities, recommendations and readiness improvements to customers.

• Set resilience engagement objectives, customer outcomes, priorities and evidence requirements; lead proactive workstreams across enterprise on-premises and cloud environments.
• Design and deliver readiness assessments, tabletop exercises, cyber range simulations, playbook development and threat modelling engagements that improve incident response readiness.
• Translate technical and operational findings into clear priorities, risk reduction actions and executive-ready recommendations.
• Evaluate customer incident response plans, roles, escalation paths, communication models, evidence readiness and recovery dependencies; establish what is mature, what remains uncertain and what needs further validation.
• Lead customer workshops and stakeholder discussions that align technical and operational teams, executives and other core business functions around practical response improvements.
• Partner with incident response, threat hunting, infrastructure, reverse engineering, product and operations teams to improve service capabilities and offering quality.
• Use customer feedback, field insights and lessons learned to improve resilience offerings, engagement methods and DART readiness practices.
• Maintain engagement documentation covering objectives, decisions, risks, dependencies and next actions; support final reporting and lessons learned.

Required / Minimum Qualifications

• A relevant degree in Computer Science, Computer Security, Statistics, Mathematics or a related field, or equivalent practical experience in cybersecurity, incident management, resilience, project management or related operations, AND 5+ years of industry experience.
• Demonstrated experience developing or delivering cybersecurity workshops, tabletop exercises, readiness assessments, incident response plans or operational resilience engagements.
• Demonstrated ability to guide stakeholders, build agreement and translate technical issues into practical actions for teams with different levels of technical knowledge.
• Experience applying cybersecurity or resilience frameworks such as NIST, MITRE ATT&CK, ISO 27001 or equivalent guidance in customer-facing work.
• Strong customer-facing written and verbal communication, including executive briefings, facilitation and clear documentation.
• Evidence of sound judgement, accurate record keeping, operational discipline and effective follow-the-sun handovers.
• Flexibility to work non-standard business hours that may include evening, nighttime, weekends and/or holidays.

Preferred Qualifications

• Experience in incident response, incident management, crisis management, resilience, security operations or enterprise risk reduction
• Experience delivering cyber range exercises, tabletop exercises, or customer readiness programmes.
• Demonstrated research, process improvement, offering development or technical mentoring that strengthens resilience capability.
• Ability to collaborate across globally distributed teams, customers and partners.

Citizenship & Citizenship Verification 

• This position requires verification of Australian citizenship due to citizenship-based legal restrictions. Specifically, this position supports United States federal, state, and/or local Australian government agency customers and is subject to certain citizenship-based restrictions where required or permitted by applicable law. To meet this legal requirement, citizenship will be verified via a valid passport.

Security Clearance Requirements 

• Ability to meet Microsoft, customer and/or government security screening requirements are required for this role.  These requirements include but are not limited to the following specialized security screenings: Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud Background Check upon hire / transfer and every two years thereafter.

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.