Job description

Overview The CISO organization represents the voice of the customer and the executive security buyer, focusing on enterprise security strategy, risk posture, and real-world security needs across industries. This team partners closely with product and engineering to ensure Microsoft Security solutions align with how organizations actually defend against threats, translating complex security challenges into actionable priorities and influencing how security is delivered at scale. It plays a critical role in shaping end-to-end security narratives, aligning product capabilities with customer outcomes, and driving trust with executives making high-stakes security decisions. CyberShield is the Microsoft Red Team program that extends our red team capability beyond Microsoft’s own estate to select external customers. Our mandate is to shift red teaming from point-in-time, human-led engagements to a software-driven, continuous model powered by agentic, AI-driven red teaming. CyberShield works across Microsoft and customer environments spanning cloud, identity , network, endpoint , hardware, and operational security domains. We are looking for Senior and Principal Security Software Engineers to design and build the offensive platform, tooling, and capabilities that power CyberShield operations. You will partner with red team operators and security engineers to automate adversary tactics, techniques, and procedures; develop capabilities for autonomous reconnaissance, vulnerability discovery, exploitation, and post-exploitation; and turn emerging tradecraft into reliable systems that operate across Microsoft and customer environments. These roles will focus on one or more of the following areas: exploit development, implant development, and agent platform development. You will provide technical leadership across disciplines, mentor other engineers, and translate operational lessons into scalable capabilities that improve how CyberShield discovers and demonstrates security risk. Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond. Responsibilities • Analyze data from Microsoft and customer engagement environments to identify potential security weaknesses and breach points, then partner with operational teams to execute targeted attacks that simulate real-world threat scenarios. • Design and build offensive tooling, implants, and agent-platform capabilities that automate reconnaissance, vulnerability discovery, exploitation, post-exploitation, and adversary emulation across Microsoft and customer environments. • Develop tools and techniques to scale and accelerate offensive emulation and vulnerability discovery • Analyze simulated adversary tactics and communications, enriching our defensive tactics and threat intelligence • Advocate for security change through building partnerships and clearly communicating impact of risks • Mentor and Guide more Software Engineers as they develop their skills and abilities • Successfully operate in uncertain and novel environments, and identify unknown risk areas Qualifications Required qualifications: • Bachelor's Degree in Computer Science or related technical field AND 4+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python • OR equivalent experience. Other Requirements: • Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings: • Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud Background Check upon hire/transfer and every two years thereafter. Preferred Qualifications: • Master's Degree in Computer Science or related technical field AND 8+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python • OR Bachelor's Degree in Computer Science or related technical field AND 12+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python • OR equivalent experience. • 3+ years experience performing red team security assessments or red team adjacent role • 3+ years experience with cloud technologies such as Azure, AWS, GCP Software Engineering IC4 - The typical base pay range for this role across the U.S. is USD $119,800 - $234,700 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $160,200 - $261,000 per year. Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here: careers.microsoft.com Software Engineering IC5 - The typical base pay range for this role across the U.S. is USD $142,800 - $274,800 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $188,000 - $304,200 per year. Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here: careers.microsoft.com This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled. Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.

Requirements

Must-haves

Develop tools and techniques to scale and accelerate offensive emulation and vulnerability discovery
Analyze simulated adversary tactics and communications, enriching our defensive tactics and threat intelligence
Advocate for security change through building partnerships and clearly communicating impact of risks
Mentor and Guide more Software Engineers as they develop their skills and abilities
Successfully operate in uncertain and novel environments, and identify unknown risk areas
3+ years experience performing red team security assessments or red team adjacent role
3+ years experience with cloud technologies such as Azure, AWS, GCP
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

Nice-to-haves

OR equivalent experience.
Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

aijavajavascriptpythonazureawsgcp

Platform: eightfold
Effort: medium