Principal Security Architect - Red Team

The Microsoft Red Team (MRT) attacks Microsoft services and technologies to identify critical and systemic security risks, demonstrate authentic attack paths, and help engineering teams, investigators, and incident responders improve their ability to protect, detect, investigate, and respond to real attacks.

Red Team operations create a unique security engineering challenge. Authorized operators use many of the same techniques as sophisticated adversaries across complex cloud, identity, endpoint, network, and application environments. Microsoft must be able to observe those operations, protect and manage the infrastructure that enables them, and distinguish authorized activity from genuine adversary activity without weakening either offensive realism or defensive response.

As a Principal Security Architect in Microsoft Red Team Engineering, you will serve as the “blue team to the Red Team.” You will set technical direction and deliver critical capabilities that make Red Team operations observable, secure, reliable, and safely distinguishable from real attacks at scale. This is a Principal individual-contributor role focused on the telemetry, detections, monitoring, deconfliction, and operational infrastructure surrounding Red Team engagements, rather than on executing the engagements themselves.

You will work at the intersection of offense and defense, partnering closely with Red Team operators, software engineers, detection engineers, security researchers, threat intelligence, incident response, and platform and telemetry teams across Microsoft. As a peer to Red Team operators, you will define what effective visibility looks like for adversarial operations, drive the right telemetry into centralized monitoring, and design and implement detections that distinguish authorized operations from real attacks using the same tradecraft.

You will shape the architecture and strategy for Red Team telemetry, monitoring, detection, alerting, deconfliction, and operational security, while working with engineers and partner teams to turn that strategy into durable production capabilities. The role requires deep security expertise, strong software and systems engineering judgment, and the ability to move between architecture and implementation, solve ambiguous cross-organization problems, and enable others to deliver at greater scale.

•    Define and drive the technical strategy and architecture for Red Team visibility, telemetry, detection, deconfliction, and operational security.
•    Use live Red Team operations, security incidents, threat intelligence, and adversary activity to identify systemic visibility and control gaps and translate them into prioritized engineering investments.
•    Architect and build scalable services and data pipelines that collect, normalize, enrich, and correlate Red Team telemetry to make the right signals available to defenders.
•    Drive the development of monitoring, hunting, detection, and alerting capabilities that help contextualize Red Team activity, identify unexpected or unauthorized behavior, and distinguish authorized operations from genuine adversary activity.
•    Build durable deconfliction capabilities that combine operational context, asset and identity information, infrastructure signals, and behavioral telemetry while protecting sensitive Red Team information.
•    Own and evolve the authoritative inventory of Red Team operational assets, ensuring infrastructure, tooling, identities, and related metadata are accurate, automated, auditable, and usable by monitoring and deconfliction systems.
•    Raise the engineering bar across Red Team systems through strong patterns for testing, reliability, observability, secure development, deployment, and infrastructure lifecycle management.
•    Provide hands-on technical leadership through architecture, implementation, reviews, debugging, operational response, and mentorship, while influencing engineering teams and roadmaps across Microsoft.
•    Help ensure Microsoft can conduct authentic Red Team operations with strong visibility, control, and confidence in its defensive response.

Required/minimum qualifications

Software Engineering IC5 - The typical base pay range for this role across the U.S. is USD $142,800 - $274,800 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $188,000 - $304,200 per year.

Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
https://careers.microsoft.com/us/en/us-corporate-pay

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.