Principal Security Research Manager
About the job
- A doctorate in Statistics, Mathematics, Computer Science, Computer Security, or a related field and 3 or more years of experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection; or a master's degree in those fields and 4 or more years of such experience; or a bachelor's degree in those fields and 6 or more years of such experience; or equivalent experience.
- At least 1 year of people-management experience.
- Design and build end-to-end evaluation harnesses for agentic security and engineering workflows, including triage, remediation, repo readiness, escalation, tool use, and scan-to-verified-closure paths.
- Create representative benchmark suites and golden datasets containing normal, edge, adversarial, failure-recovery, regression, and production-derived cases.
- Implement deterministic validators, automated graders, trace analyzers, result stores, comparison views, and workflow adapters that make evaluations repeatable and actionable.
- Measure task success, correctness, safety and policy compliance, failure recovery, latency, tool-call behavior, token usage, total cost per successful outcome, and human-review effort.
- Compare models, prompts, tools, memory strategies, policies, and orchestration patterns under consistent conditions, and help teams understand quality-versus-efficiency tradeoffs.
- Integrate evaluations into engineering workflows, CI/CD, release gates, and decision processes so material agent changes are supported by reproducible evidence before production rollout.
- Connect offline evaluation results with production feedback, including accepted and rejected outputs, human overrides, incidents, rollbacks, escaped defects, and customer or service-health signals.
- Detect regressions, benchmark drift, evaluator miscalibration, and cases where evaluation scores improve while real-world outcomes do not.
- Partner with agent builders, product teams, security engineers, data scientists, program managers, and leadership to turn evaluation results into release recommendations and autonomy-boundary decisions.
- Convert learnings into reusable paved paths, including playbooks, templates, onboarding guides, dashboards, scorecards, and reference implementations that can scale across Microsoft Security.
- Proven software engineering experience building production systems, developer platforms, test infrastructure, automation frameworks, data pipelines, quality systems, or reliability tooling.
- Ability to design and implement evaluation systems end to end, including task definition, dataset creation, harness implementation, scoring, analysis, and operational integration.
- Demonstrated coding, debugging, system design, and operational excellence skills.
- Experience working with structured data, logs, traces, metrics, APIs, automation workflows, and engineering telemetry.
- Experience with large language models, AI agents, model evaluation, prompt/tool orchestration, automated grading, evaluation harnesses, or benchmark design.
- Experience with experimentation, statistical confidence, evaluator calibration, regression analysis, human-review protocols, or quality measurement systems.
- Experience with security engineering, vulnerability management, static application security testing (SAST), software composition analysis (SCA), SARIF, remediation workflows, secure development lifecycle, or compliance-sensitive systems.
- A doctorate in Statistics, Mathematics, Computer Science, Computer Security, or a related field and 5 or more years of relevant experience; or a master's degree in those fields and 8 or more years of relevant experience; or a bachelor's degree in those fields and 12 or more years of relevant experience; or equivalent experience.
About the company
Microsoft builds workplace software, operating systems and cloud infrastructure for consumers, businesses and government agencies, from small organizations to global enterprises. Microsoft 365 combines Word and Excel with Teams communication and Copilot AI features, while Windows runs PCs and Surface supplies the company's own computers. Azure rents computing capacity, storage and databases to build and run web applications. Microsoft also sells Xbox consoles and games, collecting revenue through software licenses, subscriptions, usage charges and product sales. Founded in 1975 by Bill Gates and Paul Allen, Microsoft is headquartered in Redmond, Washington.
Company Size
10,001+
Company Stage
IPO
Headquarters
Redmond, Washington
Founded
1975
Get referred to Microsoft
See people who can refer or advise you
Simplify's Take
What believers are saying
- US corporate staff receive education support: eligible, approved graduate coursework qualifies for up to $10,000 annually.
- Cloud demand expands: July 2026 results showed Azure and other cloud services revenue grew 43% year-over-year in fiscal Q4.
- Investment has an earnings cushion: July 2026 results reported $155.2 billion consolidated operating profit for fiscal 2026.
What critics are saying
- Performance reviews include security: every Microsoft employee must discuss their security contribution with their manager.
- Office flexibility depends on the role: Microsoft's postings specify requirements ranging from fully remote to fully on-site.
- Cloud capacity faces local limits: Microsoft describes power-grid delays and water constraints affecting US datacenter expansion.
What makes Microsoft unique
- Hybrid customers stay within reach: Azure Arc manages servers across customer datacenters and competing clouds.
- Developer reach extends beyond Azure: Microsoft's GitHub hosts code collaboration alongside AI coding tools.
- Professional data widens its business: Microsoft owns LinkedIn's recruiting, advertising and workplace-learning network.
Help us improve and share your feedback! Did you find this helpful?
Benefits
Health Insurance
Dental Insurance
Vision Insurance
401(k) Company Match
Professional Development Budget
Conference Attendance Budget
Flexible Work Hours
Remote Work Options
Growth & Insights and Company News
6 month growth
0%1 year growth
0%2 year growth
0%Ensure Endpoint Technologies has made PosturePass available in Microsoft Marketplace. The app lets organisations check the security of contractor and bring-your-own-device (BYOD) devices through their existing Microsoft Entra ID Conditional Access policies. Contractors install the app themselves, with no device-management enrolment, administrator rights, or IT ticket. It checks disk encryption, antivirus, firewall status, operating system patches, remote access software, and password policy. Once a device passes, PosturePass sends a compliance signal to Microsoft Entra ID, which can then grant access. Roughly one-quarter of devices fail at least one check during initial rollout. Most owners fix the problems without help-desk involvement. PosturePass is used across thousands of devices at insurance and financial services firms. Organisations can buy it through Microsoft Marketplace, including via private offers.
Apple, Amazon, and Microsoft have each unveiled AI devices in the past week, hoping to bring generative AI into homes before the holidays. Analysts expect modest sales for now, as weak consumer sentiment and rising component costs weigh on the market. Microsoft showed a Windows laptop from $2,599 with an RTX Spark chip that runs AI without the cloud. Amazon's largest Alexa Tablet 12 Pro costs $550, and its new Alexa requires a $19.99 monthly subscription or Prime membership. Apple's HomeView smart home hub costs $299 and has a 7-inch screen and facial recognition. Its $1,999 folding iPhone Duo reaches stores next week. IDC analyst Jitesh Ubrani said the aim is to get devices into homes and teach users, laying groundwork for bigger launches.
Investor Michael Burry, known for calling the 2008 housing crash, has warned that Microsoft and other big tech firms carry roughly $3 trillion in off-balance-sheet AI data-center liabilities. He said the companies are spending heavily because they assume they will get an oligopoly "too big to fail." Microsoft's capital spending in the June quarter was $41 billion, up 70% from a year ago. Its commercial remaining performance obligations, or contracted revenue not yet recognised, exceed $678 billion. Fourth-quarter revenue rose 18% to $90 billion, and net income rose 31% to $35.8 billion. Azure passed $100 billion in annual revenue. Shares are up 41% in three months. Analysts' consensus rating is "Strong Buy," with an average price target of $577.98.
Arena Physica has made Heaviside, its foundation model for electromagnetism, available on Microsoft Discovery, Microsoft's platform for agentic engineering. The company announced the move on October 13, 2026. Heaviside-1 has 350 million parameters and was trained on 250,000 3D field simulations. It predicts a design's full 3D electromagnetic field response in milliseconds, roughly 100,000 times faster than a traditional solver, and within a decibel of commercial accuracy. Traditional solvers can take hours or days per run, which makes design verification the main bottleneck. On Discovery, an agent can switch between Heaviside's predictions and a full-fidelity solver for final validation. Arena Physica expects strong uptake in semiconductors, including BGA packaging and SerDes interconnects. Discovery also offers audit logging and access controls to protect sensitive designs.
Venture capitalist Chamath Palihapitiya said power and physical infrastructure could be the lasting constraints in the AI race. He posted on X on Monday, after Microsoft announced its own silicon chips. Palihapitiya wrote that chipmakers will move up the stack while application companies move down it, so "everyone competes with everyone." He asked whether distribution, a data moat, or a physical limit such as power would support long-term margins. Elon Musk replied that scaling power, fast construction, cooling, networking, and batteries "is hard." Microsoft chief executive officer Satya Nadella said the company will scale its Maia chips to multi-gigawatt deployments starting next year. He said the Maia 300 delivers 40% more tokens per watt than leading GPU-based systems.