Principal Security Software Engineer

Cloud operations are entering a new era. COSMIC is building agentic infrastructure that helps engineers define goals, policies, and operational intent while autonomous systems safely execute routine work across Microsoft’s largest Kubernetes fleets.

Part of M365 Substrate Core, COSMIC is modernizing Microsoft’s compute platform with turn-key geo-presence, security, high availability, fault isolation, and automated cloud buildout—improving service agility, reliability, compliance, and cost efficiency.

We are seeking a Principal Security Software Engineer to define and build the security foundation for COSMIC’s high-scale infrastructure and autonomous operations.

You will lead the architecture and delivery of platform capabilities for public key infrastructure (PKI), certificate and key lifecycle management, workload identity, secrets protection, cryptographic agility, and secure service-to-service communication across globally distributed fleets. You will connect cloud control planes, Kubernetes controllers and custom resources, authorization systems, and workload consumption paths into secure end-to-end experiences. You will design systems that make the secure path the default, automate rotation and recovery, minimize standing privilege, and remain safe and observable during failures, partial rollouts, migrations, and incidents.

Working across COSMIC, M365, and partner security organizations, you will turn ambiguous security and compliance requirements into durable platform architecture, establish engineering standards, drive multi-team execution, and raise the security capability of the broader organization through technical leadership and mentorship.

Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

• Own the security architecture, technical strategy, implementation, rollout, and operation of foundational COSMIC security services across globally distributed, high-scale infrastructure.
• Design and build highly available certificate lifecycle systems, including enrollment, issuance, secure delivery, validation, renewal, revocation, expiry prevention, trust distribution, and root and intermediate CA rotation.
• Build resilient key and secrets management capabilities, including KMS integration, encryption at rest, key-version transitions, automated reconciliation and validation, hardware-backed protection where appropriate, auditability, and emergency recovery.
• Advance identity and authorization for multi-tenant Kubernetes and cloud-native infrastructure using workload identity, scoped managed identities, namespace and workload isolation, mutual TLS, least-privilege RBAC, policy enforcement, and secure secret delivery.
• Own trust and issuer-change readiness across public and sovereign environments, including cryptographic agility, operating-system and container trust behavior, compatibility validation, migration guidance, and uninterrupted fleet availability.
• Threat model complex distributed systems and investigate cross-tenant or cross-workload privilege boundaries; translate findings into secure-by-default APIs, platform guardrails, enforcement points, migration plans, and safely deployable remediation.
• Establish security invariants, service-level objectives, inventories, expiry alerts, telemetry, detection, audit, and post-change validation that continuously demonstrate the health and integrity of certificate, key, identity, and secrets systems.
• Lead production readiness and operations through ring-based deployment, feature gating, compatibility and failure testing, automated rollback, blast-radius containment, incident response, on-call excellence, troubleshooting guidance, and durable follow-up.
• Drive end-to-end security features across control planes, resource provisioning, agents and controllers, Kubernetes custom resources, cloud authorization, and workload consumption paths, with meaningful integration and regression testing.
• Lead cross-team architecture and execution across platform, identity, cloud infrastructure, security response, and partner engineering; clarify ownership boundaries, resolve long-range dependencies, contribute production code and design documents, and mentor engineers in security and distributed-systems practices.

• Bachelor's Degree in Computer Science or related technical field AND 6+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python
  • OR equivalent experience.

Other Requirements:

Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include but are not limited to the following specialized security screenings:

• Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud background check upon hire/transfer and every two years thereafter.

Preferred Qualifications: