Principal Security Engineer

The Cloud & AI organization accelerates Microsoft's mission to ensure that our company and industry is securing digital technology platforms, devices, and clouds in our customers' heterogeneous environments, as well as ensuring the security of our own internal estate. Our culture is centered on embracing a growth mindset, a theme of inspiring excellence, and encouraging teams and leaders to bring their best each day. In doing so, we create life-changing innovations that impact billions of lives around the world. Are you passionate about emulating the world's most determined adversaries – and about teaching machines to do it alongside you? Join the Microsoft Red Team (MRT) organization, where we emulate real-world advanced persistent threats to ensure Microsoft, and the customers who depend on us, are prepared to face and respond to any adversary. CyberShield is the MRT program that extends our red team capability beyond Microsoft's own estate to select external customers. Our mandate is to shift red teaming from point-in-time, human-led engagements to a software-driven, continuous model powered by agentic, AI-driven red teaming. CyberShield operators work across Microsoft's own environment and customer environments spanning cloud, identity, network, endpoint, hardware, and operational security domains, and partner closely with Microsoft's adversary hunting organization to present a unified front to the customers we defend together. We are looking for a Principal Security Engineer to serve as a principal-level operator on CyberShield engagements. You will plan and execute full-scope adversary emulation operations end-to-end, and – critically – you will drive agentic, AI-driven red team operations: designing, directing, and supervising autonomous and semi-autonomous agents that discover, chain, and exploit weaknesses at a scale and cadence no human-only team can match. You will be a forward-deployed technical authority in front of customer security leaders, a trusted peer to senior engineers across MRT, and a force multiplier who raises the technical bar for every operator and agent on the team. Microsoft's mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond. In alignment with our Microsoft values, we are committed to cultivating an inclusive work environment for all employees to positively impact our culture every day.

Execute CyberShield red team operations end-to-end – initial access, privilege escalation, lateral movement and pivoting, persistence, objective completion, and reporting – against Microsoft's own environment and select external customer environments, using real-world adversary tactics, techniques, and procedures to validate detection, investigation, and response. Develop custom tooling, implants, and tradecraft to evade modern defenses and emulate the capabilities of advanced adversaries. Lead agentic red team operations: design and direct AI agents that autonomously perform reconnaissance, vulnerability discovery, exploitation, and post-exploitation; define guardrails, oversight, and human-in-the-loop checkpoints; and drive the shift from human-led execution to continuous, software-driven, agentic analysis. Discover and exploit vulnerabilities end-to-end across application, cloud, identity, network, hardware, and operational security layers, chaining findings into realistic attack paths that demonstrate business impact. Serve as the forward-deployed technical lead with customers: brief CISOs and security leaders, translate findings into actionable narratives, and deliver lightweight defensive engineering guidance alongside offensive results. Prototype and