Cybersecurity Lead Investigator

Technology, Data & Digital · IT Infrastructure & Security · Cybersecurity

In short

Microsoft's Detection and Response Team (DART) is seeking a skilled Cybersecurity Lead Investigator in the UK to lead complex incident responses in both cloud and on-premises environments. This role involves deep technical analysis, customer-facing communication, and directing response activities to protect organizations from cyber threats.

Responsibilities

Orchestrate evidence-driven investigations and technical incident response.
Establish investigation objectives, hypotheses, priorities, and evidence requirements.
Lead hands-on analysis across enterprise on-premises and cloud environments.
Contextualize and prioritize findings, correlate disparate evidence, and build cohesive incident timelines.
Assess adversary activity, compromise scope, and potential data exfiltration.
Direct technical response planning and recommendations.
Serve as the primary technical point of contact for complex investigations.
Brief technical teams, executives, legal, compliance, and other stakeholders.
Identify skill, access, telemetry, and resource gaps and work to resolve them.
Maintain investigative documentation and support final reporting.

Requirements

Relevant degree in Computer Science, Computer Security, Statistics, Mathematics, or equivalent practical experience.
Demonstrated hands-on experience leading large-scale, high-pressure cybersecurity incident response.
Experience setting investigation direction and guiding evidence-driven customer decisions.
Ability to correlate and assess evidence from multiple sources, reconstruct incident timelines, and evaluate compromise scope.
Experience directing response activities while balancing recovery, dependencies, and business impact.
Ability to lead technical specialists and stakeholders.
Customer-facing written and verbal communication skills, including executive briefings.
Flexibility to work non-standard business hours (evenings, nights, weekends, holidays).

Desired Qualifications

Experience analyzing nation-state or cybercrime activity and applying adversary knowledge.
Demonstrated research, analytical automation, data-quality improvement, and technical mentoring capabilities.
Experience developing technical publications, presentations, or knowledge-sharing material.
Ability to obtain Security Check (SC) or Developed Vetting (DV) clearance.
Ability to meet Microsoft, customer, and/or government security screening requirements.

Benefits

Typical base pay range: £74,700.00 - £122,600.00 per year.
Certain roles may be eligible for benefits and other compensation.
Opportunity to work with cutting-edge technology and contribute to global AI transformation.
Growth mindset, innovation, collaboration, respect, integrity, accountability, and inclusion are core values.

Skills

CybersecurityIncident ResponseCloud EnvironmentsOn-Premises EnvironmentsSecurity ResearchData AnalysisRisk Management

#Cybersecurity#Incident Response#Security Engineering#Security Research#Investigation#Cloud#On-Premises#Executive Briefings#Team Leadership#Microsoft Defender Experts

About Microsoft

Empowering every person and organization on the planet to achieve more

Every company has a mission. What's ours? To empower every person and every organization to achieve more. We believe technology can and should be a force for good and that meaningful innovation contributes to a brighter world in the future and today. Our culture doesn’t just encourage curiosity; it embraces it. Each day we make progress together by showing up as our authentic selves. We show up with a learn-it-all mentality. We show up cheering on others, knowing their success doesn't diminish our own. We show up every day open to learning our own biases, changing our behavior, and inviting…

See all open jobs at Microsoft Read more about Microsoft Website