Principal Security Architect

The Cloud & AI organization accelerates Microsoft’s mission and bold ambitions to ensure that our company and industry is securing digital technology platforms, devices, and clouds in our customers’ heterogeneous environments, as well as ensuring the security of our own internal estate. Our culture is centered on embracing a growth mindset, a theme of inspiring excellence, and encouraging teams and leaders to bring their best each day. In doing so, we create life-changing innovations that impact billions of lives around the world. Microsoft is one of the largest enterprise service companies in the world.

Productivity Security owns the risk in the environment Microsoft runs on; the tenants, systems, and platforms our own employees use to do their jobs. We are customer zero for nearly everything Microsoft ships, adopting a wide range of technology and platforms. That makes for a genuinely dynamic and heterogeneous environment, one that must keep evolving while making adoption both fast and safe. The right answer is rarely the same twice, and every control must be weighed against the productivity of hundreds of thousands of people. 

We are looking for a Principal Security Architect to join the team! Someone who thinks like an engineer as much as a security expert and has a strong sense of what actually matters. You will carry a mental model of where the environment stands and update it in real time as new signal lands, using it to enable the business, make the risk tradeoffs explicit, and influence and deliver the security capabilities the organization takes on next.  

Day to day, that means getting deep into how systems actually work, gathering and generating the signal that shows where they fall short, and setting the direction that closes the gap. Providing requirements is not the job. Knowing those systems well enough to turn requirements into durable, reusable patterns and partnering with engineering teams to get those patterns deployed is the job.  

• Keep a current read on productivity risk, maintaining a running synthesis of where the environment stands and rapidly incorporating signal as it evolves.
• Represent the security position in the room, and be prepared to go deep with engineers.
• Work closely with our engineering partners to build the tools and repeatable patterns that both reveal risk and help close it.
• Make risk legible to people who do not work in security: what it means, what it costs, and what happens if it waits.
• Decide what gets worked on next, making the call when the answer is not obvious and the facts are incomplete, then revisiting it when conditions change.
• Turn every interaction into updated priorities and those priorities into roadmaps teams can run.

Required Qualifications:

• Master's Degree in Statistics, Mathematics, Computer Science, Risk Management, Cyber Security, or related field AND 4+ years experience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detection
  • OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Risk Management, Cyber Security, or related field AND 6+ years experience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detection
    • OR equivalent experience. 

Preferred Qualifications:

• You can hold a complex, shifting picture across many moving parts and act on it without rebuilding it from scratch each time.
• You can decide with incomplete information under real pressure, defend that decision to people who disagree, and change it when the facts change.
• You read the code, query the telemetry, and build your own tooling rather than waiting for someone to hand you the answer.
• 6+ years of hands-on security experience.
• A corporate or enterprise environment at scale, where controls compete directly with productivity.
• Multiple assessment disciplines; security architecture, threat modeling, code reviews, offensive and defensive security, detection and response engineering.
• Experience with common scripting languages and working knowledge of agentic development tools. 
• A track record of making the secure thing the easy thing for other teams, through paved path.
• Practical experience working collaboratively across teams and earning trust. 

Security Assurance IC5 - The typical base pay range for this role across the U.S. is USD $142,800 - $274,800 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $188,000 - $304,200 per year.

Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
https://careers.microsoft.com/us/en/us-corporate-pay

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.