Principal Security Operations Engineering Manager

Microsoft•Sunnyvale, CA

2d•$142,800 - $304,200

About The Position

The Microsoft AI Infrastructure Information Security team protects the products, platforms, data, and technology ecosystem that support AI development and operations at scale. This role is part of the Product and Platform Security team, securing services across on-premises and cloud environments by embedding security throughout software design, development, testing, deployment, and operation. As a Principal Security Engineering Manager, you will build and lead a team of security engineers responsible for product and platform security. You will own and evolve the secure software development lifecycle (SSDLC), guide architecture and code reviews, expand threat modeling and security testing, and integrate automated guardrails into CI/CD pipelines. You will work with engineering leaders to prioritize risk, establish practical paved paths, and apply AI-assisted security workflows while providing technical guidance on complex design, reliability, and operational decisions. The role offers the opportunity to grow a high-performing security engineering team, advance secure-by-default product and platform engineering, and lead complex, multidisciplinary initiatives. Microsoft describes its culture as grounded in a growth mindset, innovation, collaboration, respect, integrity, accountability, and inclusion.

Requirements

Doctorate in Statistics, Mathematics, Computer Science, or a related field and 3+ years of experience in software development lifecycle, large-scale computing, threat modeling, cybersecurity, anomaly detection, SOC detection, threat analytics, SIEM, IT, or operations incident response; or a master's degree in one of those fields and 4+ years of relevant experience; or a bachelor's degree in one of those fields and 6+ years of relevant experience; or equivalent experience.
At least 1 year of people management experience.
Ability to meet Microsoft, customer, and/or government security screening requirements, including passing the Microsoft Background Check and Microsoft Cloud Background Check upon hire or transfer and every two years thereafter.

Nice To Haves

Doctorate in Statistics, Mathematics, Computer Science, or a related field and 5+ years of experience in software development lifecycle, large-scale computing, threat modeling, cybersecurity, or anomaly detection; or a master's degree in one of those fields and 8+ years of relevant experience; or a bachelor's degree in one of those fields and 12+ years of relevant experience; or equivalent experience.
3+ years of people management and/or informal or indirect team leadership experience.
Experience defining technical roadmaps, managing deliverables, and driving operational excellence for complex, multi-stakeholder security or infrastructure initiatives.
Experience conducting code and architecture reviews and guiding tradeoffs across security, correctness, performance, scale, reliability, and operability.
Experience with cloud infrastructure, identity and access management, authentication, authorization, workload identity, privileged access, policy enforcement, or security-critical production systems.
Knowledge of Azure, AWS, Kubernetes, CI/CD security, endpoint security, vulnerability management, observability, logging pipelines, or modern security engineering practices.
Ability to communicate security risks, technical tradeoffs, and recommendations clearly to technical, non-technical, and leadership audiences.

Responsibilities

Build, manage, coach, and develop a high-performing team of security engineers by setting objectives, enabling cross-boundary work, supporting individual growth, scaling team capabilities, and managing performance.
Define and execute the product and platform security roadmap, align objectives and key results with company priorities, and deliver measurable improvements in risk reduction, control effectiveness, engineering efficiency, and secure development maturity.
Own and continuously improve the SSDLC by integrating security requirements, architecture and code reviews, threat modeling, static and dynamic analysis, fuzzing, penetration testing, and continuous end-to-end testing.
Design and drive adoption of paved paths and developer guardrails for secure coding, cryptographic hygiene, dependency management, software supply-chain security, code integrity, and secure CI/CD across on-premises and cloud environments.
Build security tooling, automation, and AI-assisted workflows that improve coverage and technical rigor, surface useful insights, reduce operational overhead, and prevent recurring vulnerabilities.
Lead internal penetration testing and manage external security-testing partners when specialized expertise or independent validation is needed; ensure findings are prioritized and remediated and inform systemic control improvements.
Partner with engineering and product teams to identify and mitigate security risks, pressure-test designs, guide tradeoffs, and make secure approaches easier to adopt without unnecessary delivery friction.
Maintain deep technical understanding of the product and platform landscape, evolving attack techniques, and modern defensive practices; serve as an escalation point for complex or high-impact security risks.
Use findings, incidents, and post-incident insights to improve architectures, workflows, standards, and controls, and communicate business impact, technical tradeoffs, and recommendations to leaders.
Establish and report measures for program health, control effectiveness, service availability, remediation progress, operational efficiency, adoption, and risk reduction, and use evidence to prioritize security work.