Microsoft
Senior Security Engineer and Principal Security Engineer (Services)- Multiple Positions
$120K–$304K
United States · On-site · Principal · Full-time · Posted Sep 30, 2026
- Experience
- 4+ years with a qualifying master’s degree, or 6+ years with a qualifying bachelor’s degree, in security or a related field; equivalent experience is also accepted. Preferred: 2+ years identifying online-service vulnerabilities or deployment misconfigurations; 5+ years in software engineering or security-related engineering.
- Education
- Master’s degree in Statistics, Mathematics, Computer Science, or related field; or bachelor’s degree in those fields; or equivalent experience.
About the job
Secures Microsoft Windows online services by finding vulnerabilities, conducting security reviews and penetration tests, and building mitigations and tools with engineering teams.
What you'll do
- Lead security design and code reviews and penetration testing of Microsoft services.
- Build reusable agents and tools to improve security reviews; review deployments and code for defects and architectural risks.
- Demonstrate security flaws, devise protections, and collaborate with engineering teams on durable mitigations.
What they ask for
- Master’s degree in Statistics, Mathematics, Computer Science, or a related field and 4+ years of security or related experience; or bachelor’s degree in those fields and 6+ years; or equivalent experience.
- Ability to meet Microsoft, customer, and/or government security screening requirements, including the Microsoft Cloud Background Check.
Nice to have
- 2+ years identifying vulnerabilities in online services or deployment misconfigurations.
- 5+ years in software engineering or security-related engineering; public track record of relevant security research, especially vulnerability discovery.
Pay
USD $119,800 - $234,700 per year (base salary); USD $160,200 - $261,000 per year (base salary); USD $142,800 - $274,800 per year (base salary); USD $188,000 - $304,200 per year (base salary)
Model-written summary · the original posting is authoritative