Software Engineer II

Microsoft•Redmond, WA

About The Position

The MDASH team is reimagining how organizations identify and remediate vulnerabilities in source code. Using AI agents and models, MDASH analyzes code to determine whether potential vulnerabilities are real and reachable, provides developers with actionable fixes, and helps verify that vulnerabilities have been successfully addressed. The Software Engineer II will help build and evolve the MDASH scanning engine to advance agentic code scanning. The role involves designing and building systems that coordinate AI agents and models to analyze complex codebases, scale across programming languages and frameworks, validate security findings, generate high-quality fixes, and deliver reliable, efficient performance in production. The engineer will work closely with security researchers, applied scientists, model teams, and product managers to turn new techniques and evaluation insights into product capabilities. Microsoft Security works to protect customers amid digital threats, regulatory scrutiny, and complex technology estates. Microsoft’s mission is to empower every person and organization to achieve more, with a culture grounded in growth mindset, innovation, collaboration, respect, integrity, accountability, and inclusion.

Requirements

Bachelor’s degree in Computer Science or a related technical field and 2+ years of technical engineering experience coding in languages such as C, C++, C#, Java, JavaScript, TypeScript, or Python, or equivalent experience.
Ability to meet Microsoft, customer, and/or government security screening requirements, including passing the Microsoft Cloud Background Check upon hire or transfer and every two years thereafter.

Nice To Haves

Master’s degree in Computer Science or a related technical field and 3+ years of technical engineering experience coding in languages such as C, C++, C#, Java, JavaScript, TypeScript, or Python; or a bachelor’s degree in Computer Science or a related technical field and 5+ years of such experience; or equivalent experience.
Experience building production systems with large language models, such as AI agents, multi-agent orchestration, tool calling, planning, context management, or code-understanding systems.
Experience building distributed, high-scale cloud services on Azure, including containerized or sandboxed execution.
Familiarity with multiple software ecosystems and build systems across C/C++, C#, Java, JavaScript/TypeScript, Python, and cloud-native applications.

Responsibilities

Design, build, and evolve the MDASH scanning engine, including agent orchestration, multi-model routing, code understanding, vulnerability detection, reachability validation, and fix generation and verification.
Extend engine coverage across vulnerability classes, programming languages, frameworks, build systems, and codebase sizes, from single services to large monorepos.
Integrate program analysis techniques into agent workflows, including static and dynamic analysis, taint tracking, call-graph and data-flow analysis, fuzzing, and sandboxed execution.
Improve engine precision, recall, consistency, and fix quality using evaluation results, research findings, and production feedback.
Optimize scan performance, scalability, cost, and latency for enterprise-scale codebases and CI/CD workflows.
Build a secure, reliable, observable engine, with strong isolation for running untrusted code and clear telemetry for diagnosing agent behavior.
Work with security research, applied science, model, and product teams to bring new techniques and models into the engine quickly and safely.
Track the agentic security and code-scanning landscape and bring forward ideas to differentiate MDASH from competitors.
Write high-quality, well-tested code.
Lead design reviews, participate in code reviews and on-call rotations, and help raise the engineering bar for the team.