Job description

Overview The Cloud & AI organization accelerates Microsoft’s mission and bold ambitions to ensure that our company and industry is securing digital technology platforms, devices, and clouds in our customers’ heterogeneous environments, as well as ensuring the security of our own internal estate. Our culture is centered on embracing a growth mindset, a theme of inspiring excellence, and encouraging teams and leaders to bring their best each day. In doing so, we create life-changing innovations that impact billions of lives around the world. Microsoft is one of the largest enterprise service companies in the world. TEAM OVERVIEW: The Product Security Engineering team within the Regulated Industries Security Organization (RISO) helps secure some of Microsoft's most critical and highly regulated services across Healthcare, Human Resources and Corporate, External & Legal Affairs (CELA). Our team partners closely with engineering organizations to embed security into every stage of the software development lifecycle through threat modeling, security architecture reviews, security consulting, secure design guidance, and AI-driven security innovation. We are transforming how security is delivered at scale by combining deep security expertise, automation, and agentic AI capabilities. ROLE OVERVIEW: As a Principal Security Engineer , you will serve as a trusted security advisor to engineering teams and leadership, driving strategic security initiatives across complex cloud, AI, and enterprise platforms. You will lead threat modeling and architecture reviews, identify systemic security weaknesses, define reference architectures and security guidance, and partner with engineering teams to deliver durable risk reductions. You will also help shape the future of security assessment through AI-driven technologies, influencing how Microsoft scales security across regulated environments while improving developer experience and security outcomes. Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond. In alignment with our Microsoft values, we are committed to cultivating an inclusive work environment for all employees to positively impact our culture every day. Responsibilities • Partner with engineering teams to identify and mitigate security risks early in the development lifecycle through threat modeling, security design reviews, and architecture assessments for cloud and AI-powered services. • Drive secure-by-design improvements by developing security guidance, reference architectures, and practical remediation strategies that help teams address systemic security challenges and architectural anti-patterns. • Influence security outcomes across high-impact Microsoft services by working directly with engineers, architects, and product leaders to prioritize risks and accelerate security improvements. • Leverage AI and automation capabilities to scale security assessments, improve risk identification, and increase security coverage across complex product portfolios. • Investigate emerging technologies, cloud architectures, and AI workloads to uncover novel attack paths, security weaknesses, and opportunities to strengthen Microsoft's security posture. • Champion security excellence by mentoring engineering teams, enabling self-service security capabilities, and fostering secure development practices across the organization. • Contribute to the evolution of Microsoft's security assessment methodologies, tooling, and processes to improve the effectiveness, consistency, and scalability of security reviews. Qualifications Required Qualifications: • Master's Degree in Statistics, Mathematics, Computer Science, Risk Management, Cyber Security, or related field AND 4+ years experience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detection • OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Risk Management, Cyber Security, or related field AND 6+ years experience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detection • OR equivalent experience. Other Requirements: Candidates must be able to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings: • Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud background check upon hire/transfer and every two years thereafter. Preferred Qualifications: • Experience leading security strategy, architecture reviews, or security programs across multiple organizations or large-scale cloud services. • Experience designing or securing distributed systems, cloud platforms, APIs, identity solutions, or AI-enabled applications. • Knowledge of secure software development practices, common attack techniques, security controls, and risk mitigation strategies. • Proven track record identifying systemic security risks and driving organization-wide risk reduction initiatives. • Experience influencing senior engineering leadership and shaping security standards, guidance, or reference architectures. Security Assurance IC5 - The typical base pay range for this role across the U.S. is USD $142,800 - $274,800 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $188,000 - $304,200 per year. Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here: careers.microsoft.com This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled. Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.

Requirements

Must-haves

In alignment with our Microsoft values, we are committed to cultivating an inclusive work environment for all employees to positively impact our culture every day.
Partner with engineering teams to identify and mitigate security risks early in the development lifecycle through threat modeling, security design reviews, and architecture assessments for cloud and AI-powered services.
Drive secure-by-design improvements by developing security guidance, reference architectures, and practical remediation strategies that help teams address systemic security challenges and architectural anti-patterns.
Influence security outcomes across high-impact Microsoft services by working directly with engineers, architects, and product leaders to prioritize risks and accelerate security improvements.
Leverage AI and automation capabilities to scale security assessments, improve risk identification, and increase security coverage across complex product portfolios.
Investigate emerging technologies, cloud architectures, and AI workloads to uncover novel attack paths, security weaknesses, and opportunities to strengthen Microsoft's security posture.
Champion security excellence by mentoring engineering teams, enabling self-service security capabilities, and fostering secure development practices across the organization.
Contribute to the evolution of Microsoft's security assessment methodologies, tooling, and processes to improve the effectiveness, consistency, and scalability of security reviews.
Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud background check upon hire/transfer and every two years thereafter.
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

Nice-to-haves

Experience leading security strategy, architecture reviews, or security programs across multiple organizations or large-scale cloud services.
Experience designing or securing distributed systems, cloud platforms, APIs, identity solutions, or AI-enabled applications.
Knowledge of secure software development practices, common attack techniques, security controls, and risk mitigation strategies.
Proven track record identifying systemic security risks and driving organization-wide risk reduction initiatives.
Experience influencing senior engineering leadership and shaping security standards, guidance, or reference architectures.
Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

Platform: eightfold
Effort: medium