below marketmost similar roles pay hereabove market
This role pays more than
70%
of similar roles. Most pay
$122,875–$182,031
— the blue band above.
At the midpoint, this role pays about
$177k
versus about
$152k
for comparable roles.
Based on 240 similar postings.
Employer
About Microsoft
Microsoft Corporation is a global technology leader producing software, hardware, and cloud services including Windows, Office 365, Azure cloud platform, Xbox gaming, and Surface devices. Industry: Software & Cloud Computing
Microsoft currently has
692 open roles
on FindRole.
Listed pay typically runs
$119,800–$234,700
across 649 roles with salary data.
The Cybersecurity Lead Investigator joins the Detection and Response Team to serve as a primary technical point of contact for customers during security incidents. In this role, you will lead investigation direction, establish technical priorities, and orchestrate evidence-driven incident response across enterprise on-premises and cloud environments. You will coordinate specialist workstreams, correlate disparate evidence to build cohesive incident timelines, and assess adversary activity and compromise scope. Key responsibilities include directing technical response planning, briefing executive stakeholders, and managing follow-the-sun handovers. The role requires expertise in threat analysis, modeling, vulnerability research, and anomaly detection. You will solve complex security problems by balancing containment urgency with evidence preservation, providing clear findings and response options to help customers navigate high-pressure cybersecurity threats and data exfiltration risks.
Set investigation objectives, hypotheses, and priorities for enterprise on-premises and cloud environments.
Lead hands-on analysis and coordinate specialist workstreams to investigate security incidents.
Correlate disparate evidence to build cohesive incident timelines and assess adversary activity.
Direct technical response planning to balance containment, recovery urgency, and evidence preservation.
Serve as the primary technical point of contact for customers, executives, and legal stakeholders.
Identify resource gaps and escalate delivery risks to incident coordinators and leadership.
Maintain investigative documentation and manage follow-the-sun handovers for global teams.
Brief stakeholders on findings, confidence levels, and evidence-led response options.
What we're looking for
Must have a Doctorate in a relevant field and 3+ years of experience, a Master's and 3+ years, or a Bachelor's and 4+ years of experience.
Must have equivalent experience to the specified degree and years of experience requirements.
Must be able to meet Microsoft, customer, and/or government security screening requirements, including a Microsoft Cloud Background Check.
Must be able to work non-standard business hours, including 10-hour shifts from Friday through Monday, including weekends and public holidays.
Must have hands-on experience leading large-scale, high-pressure cybersecurity incident response across on-premises and cloud environments (preferred).
Must have experience analyzing nation-state or cybercrime activity and applying adversary knowledge to complex enterprise investigations (preferred).
Must have proven customer-facing written and verbal communication skills, including executive briefings (preferred).
Must have relevant security certifications or equivalent practical expertise (preferred).
Active Directory
Entra ID
Azure
Microsoft Defender XDR
Microsoft Sentinel
PowerShell
Microsoft Graph
Windows Server
DNS
DHCP
Group Policy
SIEM
SOAR
EDR
Cybersecurity Incident Response
Digital Forensics
Threat Hunting
Identity Recovery
Infrastructure Recovery
KQL
Threat Hunting
Incident Response
Windows Forensics
Linux
macOS
Active Directory
Entra ID
AWS
GCP
SIEM
EDR
Kusto Query Language
Cybersecurity
Threat Intelligence
Anomaly Detection
Machine Learning
Large Language Models
Cybersecurity
Reverse Engineering
Big Data Pipelines
Deep Learning
Anomaly Detection
Threat Hunting
Software Development Lifecycle
Root-Cause Analysis
Vulnerability Research