Senior Software Engineer
About The Position
The Trust and Integrity Protection (TrIP) team supports the company's security mission by providing services that protect systems, services, and data. This role is part of TrIP's AI Security and Application Security Team, which conducts AI penetration testing, application security, and proactive risk hunting across the Microsoft Customer and Partner Solutions (MCAPS) technology estate. The engineer proactively identifies hidden or emerging risks by connecting signals across data sources, telemetry, asset inventories, and business processes. The role performs penetration testing on AI and enterprise systems, researches novel attack techniques, and converts recurring risk patterns into automated detections, agent test cases, or policy updates. The engineer also advises business and engineering teams on risk and safe launches, communicates risk to leadership, and mentors colleagues in AI penetration testing and risk hunting.
Requirements
- Bachelor's degree in Computer Science or a related technical field and 4+ years of technical engineering experience coding in languages such as C, C++, C#, Java, JavaScript, or Python, or equivalent experience.
- 5+ years of experience identifying security vulnerabilities and working with the software development lifecycle, large-scale computing, modeling, cybersecurity, and anomaly detection.
- 5+ years of experience using penetration testing tools such as Kali Linux, Burp Suite, Nmap, and Nessus.
- Experience with one or more programming languages: Python, C#, C/C++, or PowerShell.
- Experience analyzing large data sets and telemetry to identify risk, anomalies, or threats, for example using KQL/Kusto, SQL, or Python data analysis.
- Hands-on experience with AI and LLM security, including prompt injection, agent threat modeling, and the OWASP Top 10 for LLM Applications.
- Experience in threat hunting, risk assessment, or detection engineering, including building automated detections from findings.
- Familiarity with cloud and identity security, including Azure, Entra ID, app registrations, and permissions, and with asset inventory or posture management.
- Ability to understand business processes and connect technical findings to business and operational risk.
Nice To Haves
- Master's degree in Computer Science or a related technical field and 6+ years of technical engineering experience coding in languages such as C, C++, C#, Java, JavaScript, or Python; or a bachelor's degree in a related field and 8+ years of such experience; or equivalent experience.
- Penetration testing qualifications such as GPEN/GXPN, GWAPT, OSCP/OSCE, or CRT/CCT/CCSAS.
- Microsoft Azure certifications such as AZ-900 or AZ-500.
Responsibilities
- Proactively identify risks across internal, external, and support portfolios that traditional reviews, attestations, and scans may miss.
- Connect signals across data sources, telemetry, asset inventories, and business processes to identify gaps, anomalies, and hidden or emerging risks.
- Form and test risk hypotheses, validate findings, and quantify exploitability, blast radius, and business impact.
- Drive remediation with asset owners and track identified risks to closure.
- Discover and exploit vulnerabilities end to end to assess AI systems, agents, copilots, connectors, and generative AI solutions.
- Conduct penetration testing on production AI systems using real-world adversarial tactics and techniques.
- Research and test emerging threats, including prompt injection, agent-to-agent trust abuse, tool and memory poisoning, and model supply chain risk.
- Keep current with penetration testing tools, methodologies, tactics, and mitigations.
- Convert recurring risk patterns into automated detections, agent test cases, or policy updates.
- Develop tools and techniques to scale AI penetration testing, vulnerability discovery, and risk hunting, including contributions to TrIP testing and assessment agents.
- Develop, operationalize, and maintain penetration testing and risk hunting procedures and methodologies.
- Advise business and engineering teams by translating technical risk into business impact and clear go, go-with-conditions, or no-go guidance.
- Partner with teams early in design to help them launch solutions with appropriate protections.
- Produce reports, papers, presentations, and leadership readouts on risk posture and trends.
- Mentor team members and penetration testers across Microsoft in AI penetration testing and risk hunting techniques, and collaborate with security teams on emerging trends.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
