Principal Silicon Security Architect

Microsoft•Redmond, WA

1d•$142,800 - $304,200

About The Position

Microsoft’s Silicon, Cloud, Hardware, and Infrastructure Engineering organization develops and operates infrastructure and foundational technologies supporting Microsoft’s online services and Azure. The Compute Silicon & Manufacturing Engineering organization designs, develops, manufactures, and packages Microsoft computer chips, including Azure Cobalt. The Shared and Custom IP & Silicon team supports operational success in cloud hardware manufacturing, planning, quality, delivery, scale, and sustainability. The Principal Silicon Security Architect leads security architecture for Microsoft custom silicon and SoC platforms. The role translates product threats, customer requirements, and platform security goals into hardware, firmware, and software security architectures. Its scope includes threat modeling, hardware roots of trust, secure boot and lifecycle management, attestation, confidential computing, isolation, secure debug, cryptographic services, provisioning, physical attack resistance, and security validation. The architect partners with system, silicon, IP, firmware, software, verification, validation, and external engineering teams from early concept through production and post-silicon security closure.

Requirements

Doctorate in Electrical Engineering, Computer Engineering, Computer Science, or a related field and 3+ years of technical engineering experience; or a master's degree in one of these fields and 6+ years of technical engineering experience; or a bachelor's degree in one of these fields and 8+ years of technical engineering experience; or equivalent experience.
Ability to meet Microsoft, customer, and/or government security screening requirements, including passing the Microsoft Cloud Background Check upon hire or transfer and every two years thereafter.
Ability to meet export-control eligibility requirements for access to controlled information; the successful candidate must provide proof of citizenship, U.S. residency, or other protected status, with citizenship verified using a valid passport where applicable.

Nice To Haves

15+ years of technical engineering experience; or a bachelor's degree in a related field and 12+ years of technical engineering experience; or a master's degree and 8+ years; or a doctorate and 5+ years.
Experience architecting security for data-center, cloud, client, gaming, AI accelerator, infrastructure accelerator, or server-class SoCs.
Knowledge of hardware roots of trust, security enclaves, trusted execution environments, confidential computing, secure and measured boot, attestation, secure recovery, and secure firmware update.
Knowledge of cryptographic algorithms, protocols, key hierarchies, entropy generation, crypto agility, and hardware security modules or TPM-class technologies.
Experience with device identity, secure provisioning, manufacturing security, ownership transfer, lifecycle management, anti-rollback, access control, and secure debug.
Experience analyzing and mitigating side-channel attacks, fault injection, physical attacks, microarchitectural threats, or supply-chain threats.
Experience with memory and I/O protection, IOMMU/SMMU, virtualization, privilege separation, multi-tenant isolation, or secure DMA architectures.
Experience defining security verification and validation strategies, including negative testing, penetration testing, emulation, formal methods, fuzzing, or post-silicon security validation.
Experience with security standards or certification programs such as FIPS 140-3, CNSA, TCG, DICE, SPDM, or Common Criteria.
Experience evaluating third-party security IP and working with external silicon vendors or semiconductor partners through architecture, design, verification, and productization.
Experience architecting networking or high-speed I/O subsystems, including hands-on experience with network data paths and/or packet-processing architectures.
Experience with PCI Express (PCIe) architecture, integration, or design, including link capabilities, topology, error handling, power/reset flows, hardware/firmware/software interactions, and trusted computing via PCIe TDISP/IDE.
Experience applying AI-assisted tools to architecture research, specification development, requirements analysis, or engineering productivity.

Responsibilities

Lead end-to-end security architecture for complex SoCs and silicon subsystems from product requirements and threat analysis through architecture signoff, implementation, validation, production, and post-silicon issue resolution.
Define the SoC security framework, trust boundaries, security objectives, assets, attacker models, and hardware, firmware, and software responsibilities.
Lead threat modeling and security risk assessments across hardware, firmware, software, microarchitectural, supply-chain, lifecycle, and physical attack surfaces; drive mitigations and residual-risk closure.
Architect hardware roots of trust, secure and measured boot, device identity and attestation, key management, secure provisioning, ownership transfer, lifecycle states, secure recovery, and firmware update mechanisms.
Define isolation and confidential-computing architecture, including security enclaves or trusted execution environments, memory and I/O protection, access control, privilege boundaries, virtualization, and multi-tenant security.
Define secure debug, telemetry, error handling, anti-rollback, tamper response, and manufacturing and field-service security requirements while preserving product diagnosability and supportability.
Define cryptographic services and acceleration requirements; evaluate algorithms, protocols, key hierarchies, entropy sources, and implementation tradeoffs for performance, power, area, assurance, and agility.
Assess side-channel, fault-injection, replay, rollback, and other physical or microarchitectural threats; partner with design and validation teams on mitigations and security test strategies.
Author testable security requirements and architecture specifications, maintain requirements traceability, and establish review, verification, validation, and signoff criteria.
Evaluate internal and third-party security IP and vendor solutions; lead architecture reviews and provide data-driven recommendations spanning security assurance, functionality, PPA, cost, schedule, reuse, and risk.
Drive cross-functional and cross-company technical alignment, resolve ambiguous or conflicting security requirements, and influence product and platform direction at Principal scope.