Overview

The Cloud & AI organization accelerates Microsoft’s mission and bold ambitions to ensure that our company and industry is securing digital technology platforms, devices, and clouds in our customers’ heterogeneous environments, as well as ensuring the security of our own internal estate. Our culture is centered on embracing a growth mindset, a theme of inspiring excellence, and encouraging teams and leaders to bring their best each day. In doing so, we create life-changing innovations that impact billions of lives around the world. Microsoft is one of the largest enterprise service companies in the world.

The Microsoft Security Analysis & Fix Engineering (SAFE) team is dedicated to building and leveraging the world's most advanced static analysis platform to rapidly and accurately identify security weaknesses across the billions of lines of source code that go into Microsoft's products and services, empower efficient and effective corrective action by both developers and LLMs, and build complementary analysis capabilities to enable more effectively perform proactive secure development across the entirety of Microsoft. Our ambition is to make it effortless to elevate and keep billions of lines of code at the most cutting edge of security understanding.

We are looking for a passionate and innovative Principal Security Engineer to join our highly collaborative team to help leverage our existing analysis capabilities, research and build detections to identify new security weaknesses across Microsoft products, as well as to help push the envelope of what can be detected through the development of novel analysis capabilities. The ideal candidate straddles the line of security engineer and software developer, with a deep understanding of the semantics of one or more programming languages coupled with expansive understanding of security vulnerabilities in one or more domains (Web, System, LLM/GenAI, etc.), with a strong collaborative instinct to both elevate others with their expertise, while also being elevated by others' expertise.

Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

In alignment with our Microsoft values, we are committed to cultivating an inclusive work environment for all employees to positively impact our culture every day.

Responsibilities

• Investigate code vulnerabilities and generalize code patterns for detections

• Create static code analysis rules and expressions for finding vulnerable code patterns

• Apply static code analysis and validate results manually and using automation

• Improve tooling used in static code analysis and results processing

• Assist with active incident research, detection, mitigation and post-incident response

• Embody our [culture](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcareers.microsoft.com%2Fus%2Fen%2Fculture&data=04%7C01%7CJen.

Olson%40microsoft.com%7C1be252f312044b369efd08d950f7f777%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637629848226128881%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=%2F%2BA8hiecr9UJT%2F197Wev8cVSCmVfypDQ9n8LJcInVQs%3D&reserved=0) and [values](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fabout%2Fcorporate-values&data=04%7C01%7CJen.

Olson%40microsoft.com%7C1be252f312044b369efd08d950f7f777%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637629848226128881%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4w LjAwMDAiLCJQIjoiV2lu MzIiLCJBTiI6Ik1ha WwiLCJXVCI6Mn0%3D%7C1000&sdata=YgiUSASpq%2Fe0kGUph9HFPPDS3x84Y9g Cc%2FzpsbmPPhY%3D&reserved=0)

Qualifications Required Qualifications

• Master's Degree in Statistics, Mathematics, Computer Science, Risk Management, Cyber Security, or related field AND 4+ years of experience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detection OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Risk Management, Cyber Security, or related field AND 6+ years of experience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detection OR equivalent experience.

Other Requirements:

Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings:

• Microsoft Cloud Background Check: This position will be required to pass the Microsoft background and Microsoft Cloud background check upon hire/transfer and every two years thereafter.

Preferred Qualifications:

• 5+ years of experience with 2 or more programming languages (e.g. C++, C#, Java, JavaScript, TypeScript, VBScript, Go, Ruby, Python, Rust, Swift, Powershell, PHP, SQL, etc.). Should have a firm grasp of the language semantics and behavior.

• 1+ years of experience using a query language (SQL, Linq, Splunk, Kusto, etc).

• 3+ years of experience with one or more areas of security from an App Sec standpoint, e.g. OS/System security, network and cloud security, web or mobile application security, etc.

• 3+ years of experience performing security code reviews

• 1+ years of experience with Regular Expressions

• 3+ years of experience working with cloud services and microservice architecture (preferably with Azure)

• Familiarity with .NET CLI (IL, bytecode), Java Bytecode, x86 or ARM ASM, or other compliable target

• Experience applying AI and LLM, and especially experience understanding how LLMs function

#CodeQL, #AST, #.NET, #Static Code Analysis, #Sem Grep, #Security, #Cloud, #AI, #cybersecurity, #codeanalysis

Security Assurance IC5 - The typical base pay range for this role across the U.S. is USD $139,900 - $274,800 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $188,000 - $304,200 per year.

Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
https://careers.microsoft.com/us/en/us-corporate-pay

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.