Senior Risk & Compliance Engineer

Microsoft•Sunnyvale, CA

2d•$116,900 - $222,600

About The Position

The Microsoft AI Infrastructure Information Security Governance, Risk, Automation, Compliance, and Engineering team builds and maintains a secure, scalable, and sustainable compliance environment. It partners across security, engineering, legal, privacy, audit, and other teams to translate risk and compliance requirements into implementable, monitorable, and continuously improved controls. As a Senior Risk & Compliance Engineer, you will independently own defined security risk and compliance areas from onboarding and risk assessment through control design, implementation partnership, assurance, continuous monitoring, and improvement. You will interpret regulatory, policy, customer, and assurance requirements; translate them into practical control objectives; evaluate controls across complex technical systems; and drive remediation of gaps. You will use data, telemetry, evidence pipelines, and automation to provide ongoing visibility into control health and help make compliance audit-ready by default. The role offers an opportunity to deepen technical risk and compliance expertise, advance continuous controls monitoring and compliance automation, and expand influence across security, engineering, and assurance teams. Microsoft’s mission is to empower every person and organization to achieve more. Its culture emphasizes growth mindset, innovation, collaboration, respect, integrity, accountability, and inclusion.

Requirements

Bachelor’s degree in Legal, Finance, Science, Business, Engineering, or a related field and 6+ years of experience in business, legal/regulatory, compliance, or an audit/consulting firm, or equivalent experience.
Ability to meet Microsoft, customer, and/or government security screening requirements, including passing the Microsoft Cloud Background Check upon hire or transfer and every two years thereafter.

Nice To Haves

Juris Doctor (JD) and 7+ years of experience in business, legal/regulatory, compliance, or an audit/consulting firm; or a master’s degree in Legal, Finance, Science, Business, Engineering, or a related field and 8+ years of experience; or a bachelor’s degree in one of those fields and 12+ years of experience; or equivalent experience.
Relevant certification, such as ISO Lead Auditor, Certified Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP), Certified Public Accountant (CPA), or Certified Information Privacy Professional (CIPP).
Experience translating regulatory, policy, security, or assurance requirements into technical controls and assessing control design, implementation, effectiveness, and evidence.
Experience with security and assurance frameworks such as ISO 27001, SOC 2, PCI DSS, NIST frameworks, or comparable regulatory and industry standards.
Experience using data, telemetry, dashboards, automated workflows, evidence pipelines, governance, risk, and compliance systems, or systems of record to evaluate control health and support audits.
Technical risk or compliance experience in areas such as identity and access management, application security, cloud and infrastructure security, vulnerability management, data protection, security operations, resilience, software supply-chain security, third-party security, or AI security.
Ability to identify systemic patterns across control gaps and findings, turn them into scalable technical or process improvements, and communicate risks and remediation needs clearly to technical and non-technical audiences.

Responsibilities

Independently manage defined security compliance areas end to end, evaluating applicable laws, regulations, policies, customer commitments, and assurance requirements and mapping them to risks, control objectives, controls, systems, evidence, and accountable owners.
Develop compliance program strategies and processes, anticipate new focus areas as regulatory, product, technology, and threat landscapes evolve, and escalate material non-conformance through appropriate governance channels.
Partner with security and engineering teams to define practical, measurable, and testable controls; identify potential failure points; integrate secure-by-design practices; and establish ownership, evidence, monitoring, and remediation requirements.
Analyze system architecture, data flows, configurations, access models, logs, telemetry, scripts, queries, code, and other technical artifacts to assess control design and implementation and identify compliance or coverage gaps.
Independently test control effectiveness and conduct readiness assessments; identify improvements; work with stakeholders to remediate gaps, address root causes, track issues through closure, and support incidents when needed.
Conduct routine and complex internal assessments and audits, prepare teams for external reviews, and support certifications, audits, and regulatory requirements with reliable, reusable, defensible evidence and documentation.
Translate control criteria into measurable monitoring requirements and use system-generated data, dashboards, telemetry, logs, configurations, and other signals to monitor control execution, exceptions, and health.
Develop requirements for internal tools, automated evidence collection, reusable monitoring, and compliance systems of record to reduce manual work, improve quality, and move programs toward continuous controls monitoring.
Use approved AI-enabled tools to improve compliance research, drafting, evidence review, and reporting, validating outputs through subject-matter review and traceability to authoritative sources.
Educate teams on compliance requirements, explain standards and processes to technical and non-technical audiences, collaborate on consistent application of requirements, and serve as a liaison among security, engineering, legal, privacy, audit, and business stakeholders.
Develop and report compliance metrics, key performance indicators, control health, audit issues, remediation progress, and risk trends for internal and external audiences, incorporating relevant customer feedback into program improvements.
Embody Microsoft’s culture and values.