Senior Security Engineer

Overview

Team Purpose

The Microsoft AI Infrastructure Information Security team protects the data, systems, services, and technology ecosystem that support AI development and operations at scale. You will help manage security and privacy risks across products, enterprise technologies, partners, suppliers, and third-party services by evaluating security maturity, identifying systemic threats, and providing technical guidance. Working across engineering, product, business, and security teams, you will help build scalable assurance practices that improve visibility, mitigate vulnerabilities, and support secure technology adoption.

Role Summary

As a Senior Security Engineer in the Microsoft AI Infrastructure Information Security team, you will lead large-scale security assessments of complex and high-risk applications, cloud services, artificial intelligence and machine learning services, application programming interfaces (APIs), developer platforms, infrastructure providers, and other third-party technologies. You will analyze evidence from multiple sources, lead architecture and design reviews, develop threat models, prioritize complex security issues, and drive mitigations that balance security and operational needs. You will also align stakeholders around security priorities and dependencies and advance the methodologies, automation, reusable patterns, and technical guidance used to provide security assurance at scale.

This opportunity will allow you to deepen your leadership in application, cloud, and enterprise security, advance scalable security-assessment and automation strategies, and expand your influence across multidisciplinary teams and technology partners.

Microsoft Culture Statement

Microsoft's mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

Responsibilities

• Lead large-scale, end-to-end security assessments of complex technologies and integrations, including architecture and design reviews, threat modeling, penetration testing, vulnerability analysis, and control validation across applications, cloud services, APIs, AI services, developer platforms, and infrastructure providers.

• Analyze complex issues and technical evidence from multiple sources to identify trust boundaries, attack paths, data exposure, identity and privilege risks, software supply-chain weaknesses, and less common security threats; make informed tradeoffs and drive systemic issues to resolution.

• Evaluate products and services against security baselines, assess the impact of identified risks, and work with engineering, operations, research, and technology-provider leads to define and implement appropriate remediation or compensating controls.

• Provide security and architectural guidance throughout the development lifecycle, ensure relevant security design and development practices are in place, and develop reusable requirements, secure patterns, and best practices that prevent recurring issues.

• Build connections and agreements across engineering, product, business, partner, and security teams to clarify priorities and dependencies, communicate complex risk, incorporate customer and partner feedback, and escalate blocking issues when needed.

• Plan security analysis for large feature areas and multi-stakeholder reviews by accounting for product schedules, milestones, dependencies, risk assessments, and stakeholder effort while adapting plans as findings and business needs evolve.

• Lead clear reporting on findings, recommendations, risk, control effectiveness, and program outcomes; monitor and respond to security events, potential vulnerabilities, exposures, and policy-compliance issues.

• Create and drive adoption of mitigations, assessment methodologies, self-service resources, and readiness frameworks that improve security posture and enable informed decisions about third-party technologies.

• Architect and implement security tooling, automated workflows, and standardized processes, including appropriate uses of machine learning and generative AI, to expand coverage, improve vulnerability identification, validate controls, and reduce operational overhead.

• Maintain expertise across application security, cloud security, identity and access management, data protection, vulnerability management, incident response, and enterprise security tools, and share that expertise through guidance, coaching, and technical forums.

• Embody our culture and values

Qualifications

Required Qualifications:

• Master's Degree in Statistics, Mathematics, Computer Science, Risk Management, Cyber Security, or related field AND 3+ years experience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detection

• OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Risk Management, Cyber Security, or related field AND 4+ years experience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detection

• OR equivalent experience.

Other Requirements:

Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings:

Microsoft Cloud Background Check:

• This position will be required to pass the Microsoft background and Microsoft Cloud background check upon hire/transfer and every two years thereafter.

Preferred Qualifications

• Master's Degree in Statistics, Mathematics, Computer Science, Risk Management, Cyber Security, or related field AND 6+ years experience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detection (enterprise experience)

• OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Risk Management, Cyber Security, or related field AND 8+ years experience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detection (enterprise experience)

• OR equivalent experience.

• Experience independently leading complex security assessments from architecture review through risk identification, remediation, and control validation.

• Experience building or scaling third-party security, vendor security, supply chain security, or comparable security-assurance programs in a large-scale technology environment.

• Strong knowledge of modern application, SaaS, and cloud architectures, APIs, identity federation, OAuth or OpenID Connect, privileged access, data protection, and software supply-chain security.

• Experience designing scalable software, automation, or security tooling that improves assessment coverage, control validation, attack-surface identification, or continuous security monitoring.

• Experience with on-premises and multicloud environments or enterprise security technologies such as data loss prevention (DLP), data security posture management (DSPM), SaaS security posture management (SSPM), or endpoint detection and response (EDR).

• Ability to communicate complex technical security risks clearly, build agreement across diverse perspectives, and influence engineering, business, and technology-provider leaders.

Security Assurance IC4 - The typical base pay range for this role across the U.S. is USD $119,800 - $234,700 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $160,200 - $261,000 per year.

Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:

https://careers.microsoft.com/us/en/us-corporate-pay

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations. (https://careers.microsoft.com/v2/global/en/accessibility.html)