Security Assurance IC5

Microsoft • Redmond, WA

6d

About The Position

The Cloud & AI organization accelerates Microsoft’s mission and bold ambitions to ensure that our company and industry is securing digital technology platforms, devices, and clouds in our customers’ heterogeneous environments, as well as ensuring the security of our own internal estate. Our culture is centered on embracing a growth mindset, a theme of inspiring excellence, and encouraging teams and leaders to bring their best each day. In doing so, we create life-changing innovations that impact billions of lives around the world. Microsoft is one of the largest enterprise service companies in the world.
The Microsoft Security Analysis & Fix Engineering (SAFE) team is dedicated to building and leveraging the world's most advanced static analysis platform to rapidly and accurately identify security weaknesses across the billions of lines of source code that go into Microsoft's products and services, empower efficient and effective corrective action by both developers and LLMs, and build complementary analysis capabilities to enable more effectively perform proactive secure development across the entirety of Microsoft. Our ambition is to make it effortless to elevate and keep billions of lines of code at the most cutting edge of security understanding.
We are looking for a passionate and innovative Principal Security Engineer to join our highly collaborative team to help leverage our existing analysis capabilities, research and build detections to identify new security weaknesses across Microsoft products, as well as to help push the envelope of what can be detected through the development of novel analysis capabilities. The ideal candidate straddles the line of security engineer and software developer, with a deep understanding of the semantics of one or more programming languages coupled with expansive understanding of security vulnerabilities in one or more domains (Web, System, LLM/GenAI, etc.), with a strong collaborative instinct to both elevate others with their expertise, while also being elevated by others' expertise.

Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

In alignment with our Microsoft values, we are committed to cultivating an inclusive work environment for all employees to positively impact our culture every day.

Requirements

• Master's Degree in Statistics, Mathematics, Computer Science, Risk Management, Cyber Security, or related field AND 4+ years of experience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detection OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Risk Management, Cyber Security, or related field AND 6+ years of experience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detection OR equivalent experience.
• Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings:
• Microsoft Cloud Background Check: This position will be required to pass the Microsoft background and Microsoft Cloud background check upon hire/transfer and every two years thereafter.

Nice To Haves

• 5+ years of experience with 2 or more programming languages (e.g. C++, C#, Java, JavaScript, TypeScript, VBScript, Go, Ruby, Python, Rust, Swift, Powershell, PHP, SQL, etc.). Should have a firm grasp of the language semantics and behavior.
• 1+ years of experience using a query language (SQL, Linq, Splunk, Kusto, etc).
• 3+ years of experience with one or more areas of security from an AppSec standpoint, e.g. OS/System security, network and cloud security, web or mobile application security, etc.
• 3+ years of experience performing security code reviews
• 1+ years of experience with Regular Expressions
• 3+ years of experience working with cloud services and microservice architecture (preferably with Azure)
• Familiarity with .NET CLI (IL, bytecode), Java Bytecode, x86 or ARM ASM, or other compliable target
• Experience applying AI and LLM, and especially experience understanding how LLMs function
• #CodeQL, #AST, #.NET, #StaticCodeAnalysis, #SemGrep, #Security, #Cloud, #AI, #cybersecurity, #codeanalysis

Responsibilities

• Investigate code vulnerabilities and generalize code patterns for detections
• Create static code analysis rules and expressions for finding vulnerable code patterns
• Apply static code analysis and validate results manually and using automation
• Improve tooling used in static code analysis and results processing
• Assist with active incident research, detection, mitigation and post-incident response
• Embody our culture and values

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level