Security Researcher – Cybersecurity Lead Investigator

Overview

As Lead Investigator on the DART, you drive evidence-driven incident response across on-premises and cloud environments. You will lead investigations, set objectives and coordinate specialist workstreams while serving as the technical point of contact for customers and executives. You shape response recommendations that balance rapid recovery with evidence preservation. This role offers impact across global teams and opportunities to mentor peers while advancing Defender Experts Cybersecurity Incident Response. You will work in a mission-driven, collaborative environment focused on secure, scalable outcomes.

Responsibilities

• Orchestrate evidence-driven investigations and incident response across enterprise environments
• Set objectives, hypotheses, and evidence requirements; lead hands-on analysis and specialist workstreams
• Contextualise findings, build incident timelines, and communicate priorities to customers
• Assess adversary activity, scope, and potential exfiltration; explain confidence and uncertainty
• Direct technical response planning to balance containment, recovery, and evidence preservation
• Coordinate with customer-approved teams and specialists to execute plans
• Serve as primary technical contact for complex investigations; brief stakeholders including executives
• Identify gaps, secure resources, and escalate delivery risks with incident coordinators and leadership
• Maintain investigative documentation and support final reporting and lessons learned

Key requirements

• Hands-on experience leading large-scale cybersecurity incident response across on-premises and cloud environments
• Ability to correlate evidence from multiple sources and reconstruct incident timelines
• Experience directing response activities balancing rapid recovery with technical dependencies and business impact
• Proven leadership of technical specialists and cross-functional stakeholders in a global follow-the-sun model
• Customer-facing written and verbal communication, including executive briefings
• Flexibility to work non-standard hours

• leadership
• clear communication
• collaboration
• incident response
• forensics and evidence analysis
• timeline reconstruction

…