Principal Silicon Security Architect

Microsoft • Redmond, WA

3h

About The Position

Microsoft Silicon, Cloud Hardware, and Infrastructure Engineering (SCHIE) builds and operates the infrastructure and foundational technologies that support Microsoft’s online businesses and Azure platform. Within SCHIE, the Compute Silicon & Manufacturing Engineering (CSME) organization designs, develops, manufactures, and packages Microsoft computer chips, including Azure Cobalt. The Shared and Custom IP & Silicon (SCIPS) team supports the planning, quality, delivery, scale, and sustainability of Microsoft cloud hardware.

Microsoft is seeking a Principal Silicon Security Architect to lead security architecture for custom silicon and SoC platforms. The architect will turn product threats, customer requirements, and platform security goals into actionable hardware, firmware, and software architectures. The role covers threat modeling, hardware roots of trust, secure boot and lifecycle management, attestation, confidential computing, isolation, secure debug, cryptographic services, provisioning, physical-attack resistance, and security validation.

The architect will work with system, silicon, IP, firmware, software, verification, validation, and external engineering teams, from early concepts through production and post-silicon security closure. The role requires cross-functional technical leadership and influencing product and platform direction at Principal scope.

Requirements

• Doctorate in Electrical Engineering, Computer Engineering, Computer Science, or a related field and 3 or more years of technical engineering experience; or a master's degree in one of these fields and 6 or more years of experience; or a bachelor's degree in one of these fields and 8 or more years of experience; or equivalent experience.
• Ability to meet Microsoft, customer, and/or government security screening requirements, including passing the Microsoft Cloud Background Check upon hire or transfer and every two years thereafter.
• This role requires access to information controlled under export-control regulations. The successful candidate must provide proof of citizenship, U.S. residency, or other protected status for eligibility assessment; citizenship will be verified with a valid passport, with other applicable documentation accepted for lawful permanent residents, refugees, and asylees.

Nice To Haves

• 15 or more years of technical engineering experience; or a bachelor's degree in Electrical Engineering, Computer Engineering, Computer Science, or a related field and 12 or more years of experience; or a master's degree in one of these fields and 8 or more years of experience; or a doctorate in one of these fields and 5 or more years of experience.
• Experience architecting security for data-center, cloud, client, gaming, AI accelerator, infrastructure accelerator, or server-class SoCs.
• Knowledge of hardware roots of trust, security enclaves, trusted execution environments, confidential computing, secure and measured boot, attestation, secure recovery, and secure firmware updates.
• Knowledge of cryptographic algorithms, protocols, key hierarchies, entropy generation, crypto agility, and hardware security modules or TPM-class technologies.
• Experience with device identity, secure provisioning, manufacturing security, ownership transfer, lifecycle management, anti-rollback, access control, and secure debug.
• Experience analyzing and mitigating side-channel attacks, fault injection, physical attacks, microarchitectural threats, or supply-chain threats.
• Experience with memory and I/O protection, IOMMU/SMMU, virtualization, privilege separation, multi-tenant isolation, or secure DMA architectures.
• Experience defining security verification and validation strategies, including negative testing, penetration testing, emulation, formal methods, fuzzing, or post-silicon security validation.
• Experience with security standards or certification programs such as FIPS 140-3, CNSA, TCG, DICE, SPDM, or Common Criteria.
• Experience evaluating third-party security IP and working with external silicon vendors or semiconductor partners through architecture, design, verification, and productization.
• Experience architecting networking or high-speed I/O subsystems, including hands-on experience with network data paths and/or packet-processing architectures.
• Experience with PCI Express (PCIe) architecture, integration, or design, including link capabilities, topology, error handling, power/reset flows, hardware/firmware/software interactions, and trusted computing via PCIe TDISP/IDE.
• Experience applying AI-assisted tools to architecture research, specification development, requirements analysis, or engineering productivity.

Responsibilities

• Lead end-to-end security architecture for complex SoCs and silicon subsystems, from product requirements and threat analysis through architecture signoff, implementation, validation, production, and post-silicon issue resolution.
• Define the SoC security framework, trust boundaries, security objectives, assets, attacker models, and hardware, firmware, and software responsibilities.
• Lead threat modeling and security risk assessments across hardware, firmware, software, microarchitectural, supply-chain, lifecycle, and physical attack surfaces; drive mitigations and residual-risk closure.
• Architect hardware roots of trust, secure and measured boot, device identity and attestation, key management, secure provisioning, ownership transfer, lifecycle states, secure recovery, and firmware update mechanisms.
• Define isolation and confidential-computing architecture, including enclaves or trusted execution environments, memory and I/O protection, access control, privilege boundaries, virtualization, and multi-tenant security.
• Define secure debug, telemetry, error handling, anti-rollback, tamper response, and manufacturing and field-service security requirements while preserving diagnosability and supportability.
• Define cryptographic services and acceleration requirements; evaluate algorithms, protocols, key hierarchies, entropy sources, and implementation tradeoffs for performance, power, area, assurance, and agility.
• Assess side-channel, fault-injection, replay, rollback, and other physical or microarchitectural threats; partner with design and validation teams on mitigations and security test strategies.
• Author testable security requirements and architecture specifications, maintain requirements traceability, and establish review, verification, validation, and signoff criteria.
• Evaluate internal and third-party security IP and vendor solutions; lead architecture reviews and provide data-driven recommendations spanning security assurance, functionality, PPA, cost, schedule, reuse, and risk.
• Drive cross-functional and cross-company technical alignment, resolve ambiguous or conflicting security requirements, and influence product and platform direction at Principal scope.

Benefits

• Certain roles may be eligible for benefits and other compensation; additional benefits and pay information is available at the Microsoft careers pay-information page.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal