Principal Security Operations Engineering Manager

Microsoft•Sunnyvale, CA

About The Position

The Microsoft AI Infrastructure Information Security team protects the products, platforms, data, and technology ecosystem that support AI development and operations at scale. This role helps secure services across on-premises and cloud environments by embedding security into software design, development, testing, deployment, and operations. It works across engineering, product, infrastructure, security, and business teams to build secure-by-default development practices that reduce systemic risk while enabling teams to deliver quickly. As a Principal Security Engineering Manager, you will build and lead a team responsible for product and platform security. You will own and evolve the secure software development lifecycle (SSDLC), guide architecture and code reviews, expand threat modeling and security testing, and integrate automated guardrails into CI/CD pipelines. You will partner with engineering leaders to prioritize risk, establish practical paved paths, and apply AI-assisted security workflows, while retaining the technical depth to guide complex design, reliability, and operational decisions. The role offers the opportunity to grow a high-performing security engineering team, advance secure-by-default product and platform engineering, and lead complex multidisciplinary initiatives.

Requirements

Doctorate in Statistics, Mathematics, Computer Science, or a related field and at least 3 years of experience in software development lifecycle, large-scale computing, threat modeling, cybersecurity, anomaly detection, SOC detection, threat analytics, SIEM, IT, or operations incident response; or a master's degree in one of these fields and at least 4 years of such experience; or a bachelor's degree in one of these fields and at least 6 years of such experience; or equivalent experience.
At least 1 year of people management experience.
Ability to meet Microsoft, customer, and/or government security screening requirements, including passing the Microsoft background and Microsoft Cloud background check upon hire or transfer and every two years thereafter.

Nice To Haves

Doctorate in Statistics, Mathematics, Computer Science, or a related field and at least 5 years of experience in software development lifecycle, large-scale computing, threat modeling, cybersecurity, or anomaly detection; or a master's degree in one of these fields and at least 8 years of such experience; or a bachelor's degree in one of these fields and at least 12 years of such experience; or equivalent experience.
At least 3 years of people management and/or informal or indirect team leadership experience.
Experience defining technical roadmaps, managing deliverables, and driving operational excellence for complex, multi-stakeholder security or infrastructure initiatives.
Experience conducting code and architecture reviews and guiding tradeoffs across security, correctness, performance, scale, reliability, and operability.
Experience with cloud infrastructure, identity and access management, authentication, authorization, workload identity, privileged access, policy enforcement, or security-critical production systems.
Knowledge of Azure, AWS, Kubernetes, CI/CD security, endpoint security, vulnerability management, observability, logging pipelines, or modern security engineering practices.
Ability to communicate security risks, technical tradeoffs, and recommendations clearly to technical, non-technical, and leadership audiences.

Responsibilities

Build, manage, coach, and develop a high-performing security engineering team by setting clear objectives, enabling cross-team success, investing in individual growth, scaling capabilities, and managing performance.
Define and execute the product and platform security roadmap, align objectives and key results with company priorities, and deliver measurable improvements in risk reduction, control effectiveness, engineering efficiency, and secure development maturity.
Own and continuously improve the SSDLC by integrating security requirements, architecture and code reviews, threat modeling, static and dynamic analysis, fuzzing, penetration testing, and continuous end-to-end testing.
Design and drive adoption of developer paved paths and guardrails for secure coding, cryptographic hygiene, dependency management, software supply-chain security, code integrity, and secure CI/CD across on-premises and cloud environments.
Build security tooling, automation, and AI-assisted workflows that improve coverage and technical rigor, surface valuable insights, reduce operational overhead, and prevent recurring vulnerability classes.
Lead internal penetration testing and manage external security-testing partners when specialized expertise or independent validation is needed; ensure findings are prioritized, remediated, and used to improve systemic controls.
Partner with engineering and product teams to identify and mitigate security risks, pressure-test designs, guide tradeoffs, and make secure approaches easier to adopt without creating unnecessary delivery friction.
Maintain deep technical understanding of the product and platform landscape, evolving attack techniques, and modern defensive practices; serve as an escalation point for complex or high-impact security risks.
Use findings, incidents, and post-incident insights to improve architectures, workflows, standards, and controls, and communicate business impact, technical tradeoffs, and recommendations to leaders.
Establish and report measures for program health, control effectiveness, service availability, remediation progress, operational efficiency, adoption, and risk reduction, using evidence to prioritize security work.