Principal Penetration Tester

Microsoft•Redmond, WA

13d•Hybrid

About The Position

Join Microsoft’s Cloud Operations + Innovation (CO+I) organization, which operates the technology and infrastructure behind Microsoft’s cloud. As part of the Trusted Cyber Engineering team, you will test physical and logical security systems supporting global datacenters, including cloud services, networks, hardware, and operational technology for critical infrastructure such as power, cooling, and building management systems. This is a hands-on individual contributor role and technical lead for the penetration testing function, helping shape the team’s strategy and mature its capabilities. The role emphasizes collaboration with partners, effective issue resolution, security innovation, and guidance for colleagues and strategic partners. The preferred work arrangement is three days per week in the Redmond, Washington office, but qualified candidates unable to meet this preference are welcome.

Requirements

Master’s degree in Statistics, Mathematics, Computer Science, or a related field and 4+ years of experience in security or a related field; or bachelor’s degree in one of these fields and 6+ years of experience; or equivalent experience.
Ability to meet Microsoft, customer, and/or government security screening requirements, including passing the Microsoft Cloud Background Check upon hire or transfer and every two years thereafter.
Citizenship verification is required due to citizenship-based legal restrictions; the successful candidate’s citizenship will be verified using a valid passport.

Nice To Haves

6+ years of experience identifying security vulnerabilities, software development lifecycle, large-scale computing, modeling, cybersecurity, and anomaly detection.
6+ years of coding or scripting experience with languages such as C#, Python, C++, Go, PowerShell, .NET, Rust, or comparable languages.
Familiarity with security standards and frameworks such as OWASP, MITRE ATT&CK, and NIST.
3+ years of experience leading a penetration testing team, including hiring, mentoring, and managing full-time and vendor engineers.
Relevant offensive security certifications such as OffSec OSCP, OSEP/OSCE³, GPEN, GXPN, or similar; OT/ICS certifications such as GICSP or GRID.
Experience using open-source and open-weight large language models and chunking, embeddings, and RAG techniques.
Expertise in developing KQL queries, data models, anomaly detection, correlation analytics, and statistical analysis.
Deep understanding of Azure; experience with AWS or GCP.
Knowledge of operational technology and Industrial Control Systems security.
Organizational and technical program management skills, including the ability to convey complex concepts to diverse audiences.
Proficiency with Power BI and Azure DevOps for reporting and tracking.

Responsibilities

Lead and participate in comprehensive penetration testing across applications, cloud, networks, hardware, and critical infrastructure operational technology systems.
Identify security vulnerabilities and conduct end-to-end adversary emulation within approved rules of engagement across multiple areas of responsibility.
Operate in uncertain, challenging, and novel environments and perform offensive and defensive security operations.
Identify unknown risk areas and apply expertise to address them appropriately.
Build relationships that enable efficient communication and collaboration, advocating for security changes across the organization.
Provide strategic guidance on team priorities, tactics, evaluation strategies, and methodology development.
Chain findings into attack paths that demonstrate operational and business impact.
Organize and direct team work involving engagement rules, scoping, executive risk communications, and technical guidance for operations.
Lead the team’s rhythm of business to ensure remediation is completed according to defined SLAs and reporting and communications are delivered on time.
Create executive-level verbal and written presentations explaining penetration testing and technical information to non-technical audiences.
Present data-driven reporting on operations, impact, risks, vulnerabilities, system information, and remediation plans and potential impact.
Work as a technical operator across penetration testing offerings, identifying and exploiting misconfigurations, improving detection capabilities, and enhancing threat visibility.
Research emerging threats, vulnerabilities, tools, attack techniques, and security trends.
Mentor and guide team members and partners, fostering curiosity, collaboration, and technical excellence.
Partner with detection, threat intelligence, and incident response teams to turn findings into actionable detections.
Apply AI and automation to scale reconnaissance, discovery, and testing.