Senior Software Engineer

Overview

The Trust and Integrity Protection (TrIP) team supports the company's overall security mission by providing key security services that help protect systems, services and data. We are looking for a motivated cybersecurity engineer with experience in AI penetration testing and proactive risk hunting.

Are you passionate about finding security vulnerabilities and hidden risk in enterprise-scale systems, with a specific focus on Artificial Intelligence? Do you want to find the risks that traditional reviews, attestations and scans miss? TrIP's AI Security and Application Security Team is responsible for AI penetration testing, application security and risk hunting across the entire Microsoft Customer and Partner Solutions (MCAPS) technology estate.

As a member of TrIP's AI Security and Application Security Team, you will hunt for risk proactively by connecting signals across data sources, telemetry, inventories and business processes. You will perform AI penetration testing against AI and enterprise systems, develop novel attack techniques, and turn systemic, repeating risk patterns into automated detections and agent test cases. You will also act as a trusted risk advisor, helping business and engineering teams launch solutions safely and giving leadership clear visibility into risk.

Responsibilities

Proactive risk indentification and discovery

• Proactively find risks that traditional methods such as reviews, attestations and scans do not catch, across the internal, external and support portfolios.

• Use data sources, telemetry, asset inventories and business processes to connect signals across systems, spot gaps and anomalies, and uncover hidden or emerging risk.

• Form and test risk hypotheses, validate findings, and quantify exploitability, blast radius and business impact.

• Drive remediation with asset owners and track risk to closure.

AI penetration testing and novel scenarios

• Discover and exploit vulnerabilities end to end to assess the security of AI systems, agents, copilots, connectors and generative AI solutions.

• Execute penetration testing operations on production AI systems using real-world adversarial tactics and techniques.

• Research and test new and emerging threats, including prompt injection, agent-to-agent trust abuse, tool and memory poisoning and model supply chain risk, before they areexploited.

• Stay current with penetration testing tools, methodologies, tactics and mitigations.

Accelerate

• Turn systemic, repeating risk patterns into automated detections, agent test cases or policy updates, so the same class of risk is caught at scale without another manual hunt.

• Develop tools and techniques that scale AI penetration testing, vulnerability discovery and risk hunting, including contributions to TrIP testing and assessment agents.

• Develop, operationalize and maintain penetration testing and risk hunting procedures and methodologies. Business enablement

• Act as a trusted risk advisor, translating technical risk into business impact and clear go, go-with-conditions or no-go guidance.

• Partner with teams early in design to help them launch solutions with the right protections instead of being blocked late.

• Produce high-quality reports, papers and presentations, including risk posture and trend readouts for leadership.

• Mentor team members and pen testers across Microsoft in AI penetration testing and risk hunting techniques, and collaborate with other security teams on emerging trends.

Qualifications

Required Qualifications

• Bachelor's Degree in Computer Science or related technical field AND 4+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python OR equivalent experience.

Preferred Qualifications

• Master's Degree in Computer Science or related technical field AND 6+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python OR Bachelor's Degree in Computer Science or related technical field AND 8+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python OR equivalent experience.
• 5+ years of experience in identifying security vulnerabilities, software development lifecycle, large-scale computing, modeling, cyber security and anomaly detection.
• 5+ years of experience using common penetration testing tools such as Kali Linux, Burp Suite, Nmap and Nessus.
• 5+ years of experience with one or more programming languages: Python, C#, C/C++, PowerShell.
• Experience analyzing large data sets and telemetry to identify risk, anomalies or threats (for example, KQL/Kusto, SQL or Python data analysis).
• Hands-on experience with AI and LLM security, including prompt injection, agent threat modeling and the OWASP Top 10 for LLM Applications.
• Experience in threat hunting, risk assessment or detection engineering, including building automated detections from findings.
• Familiarity with cloud and identity security (Azure, Entra ID, app registrations and permissions) and asset inventory or posture management.
• Ability to understand business processes and connect technical findings to business and operational risk.
• Penetration testing qualifications such as GPEN/GXPN, GWAPT, OSCP/OSCE or CRT/CCT/CCSAS.
• Microsoft Azure certifications such as AZ-900 or AZ-500.

Software Engineering IC4 - The typical base pay range for this role across the U.S. is USD $119,800 - $234,700 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $160,200 - $261,000 per year.

Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
https://careers.microsoft.com/us/en/us-corporate-pay

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

---

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.