Andrew Lynes

Andrew Lynes is a Lead Investigator with Microsoft Incident Response (Microsoft IR), where he leads complex cyber intrusion investigations — coordinating technical response activities to contain threats, determine root cause, and support organisational recovery. Delivered by Microsoft’s Detection and Response Team (DART), Microsoft IR supports customers before, during, and after cyber incidents to remove threat actors, restore systems, and strengthen long‑term resilience against future attacks.

Andrew has over 25 years of IT industry experience, including more than 20 years at Microsoft. During that time, he has held a range of technical roles including software developer, solution architect, and enterprise support engineer. Most recently he was a security architect within Microsoft Industry Solutions, where he worked with a global team of specialists to help customers modernise their security strategies using Microsoft’s security technologies.