Lead Cybersecurity Incident Response Investigator

microsoft operations pte ltd; Singapore; On-site; SGD 120,000 - 190,000; Full time

Job summary

Microsoft Singapore is seeking a Cybersecurity Lead Investigator to lead complex incident response across on-premises and cloud environments, coordinating with threat hunters, reverse engineers and incident coordinators to deliver clear, defensible recommendations to customers.

You will set objectives, prioritize evidence, manage follow-the-sun engagements, brief executives and legal teams, and mentor junior colleagues while balancing rapid recovery with evidence preservation.

Qualifications

• A relevant degree in Computer Science, Computer Security, Statistics, Mathematics or a related field, or equivalent practical experience in cybersecurity, incident management or related operations, AND 5+ years of industry experience.
• Demonstrated hands-on experience leading large-scale, high-pressure cybersecurity incident response across on-premises and cloud environments, including setting investigation direction and guiding evidence-driven customer decisions.
• Ability to correlate and assess evidence from multiple sources, reconstruct incident timelines, evaluate compromise scope and possible exfiltration, and clearly explain findings and uncertainty.
• Experience directing response activities while balancing rapid recovery, technical dependencies and business impact.
• Demonstrated ability to lead technical specialists and stakeholders, identify engagement gaps, request appropriate resources and manage investigations using a global follow-the-sun model.
• Strong customer-facing written and verbal communication, including executive briefings.
• Ability to occasionally work outside standard business hours, including evenings, nights, weekends and public holidays, based on business needs.

Responsibilities

• As a Lead Investigator, you will orchestrate evidence-driven investigations and technical incident response, align specialist workstreams and communicate clear findings, priorities and recommendations to customers.
• Set investigation objectives, hypotheses, priorities and evidence requirements; lead hands-on analysis and specialist workstreams across enterprise on-premises and cloud environments.
• Contextualise and prioritise findings, correlate disparate evidence and build cohesive incident timelines. Establish what is known, what remains uncertain and what additional collection or analysis is needed.
• Assess adversary activity, compromise scope and potential data collection or exfiltration; validate key findings and explain the confidence and limitations of conclusions.
• Direct technical response planning and recommendations to secure enterprise environments, balancing containment and recovery urgency with evidence preservation and customer business constraints. Coordinate execution with customer-authorised teams and relevant specialists.
• Serve as the primary technical point of contact for complex investigations; brief technical teams, executives, legal, compliance, engineering and other stakeholders with clear objectives, findings and decision options.
• Identify skill, access, telemetry and resource gaps early; work with incident coordinators and leadership to resolve dependencies, obtain specialist support and elevate delivery risks.
• Maintain investigative documentation and clear follow-the-sun handovers covering evidence, hypotheses, decisions, risks and next actions; support final reporting and lessons learned.

Skills

Incident response leadership

Cloud/on-prem analysis

Executive communication

Cross-functional coordination

Security incident management

Education

Bachelors in Computer Science or related field

Job description

Microsoft Singapore is seeking a Cybersecurity Lead Investigator to lead complex incident response across on-premises and cloud environments, coordinating with threat hunters, reverse engineers and incident coordinators to deliver clear, defensible recommendations to customers.

You will set objectives, prioritize evidence, manage follow-the-sun engagements, brief executives and legal teams, and mentor junior colleagues while balancing rapid recovery with evidence preservation.