Senior Security Engineer - Microsoft Red Team

Overview

The Cloud & AI organization accelerates Microsoft's mission to ensure that our company and industry is securing digital technology platforms, devices, and clouds in our customers' heterogeneous environments, as well as ensuring the security of our own internal estate. Our culture is centered on embracing a growth mindset, a theme of inspiring excellence, and encouraging teams and leaders to bring their best each day. In doing so, we create life-changing innovations that impact billions of lives around the world.

Are you passionate about emulating the world's most determined adversaries, and about teaching machines to do it alongside you? Join the Microsoft Red Team (MRT) organization, where we emulate real-world advanced persistent threats to ensure Microsoft, and the customers who depend on us, are prepared to face and respond to any adversary.

CyberShield is the MRT program that extends our red team capability beyond Microsoft's own estate to select external customers. Our mandate is to shift red teaming from point-in-time, human-led engagements to a software-driven, continuous model powered by agentic, AI-driven red teaming.

CyberShield operators work across Microsoft's own environment and customer environments spanning cloud, identity, network, endpoint, hardware, and operational security domains, and partner closely with Microsoft's adversary hunting organization to present a unified front to the customers we defend together.

We are looking for a Senior Security Engineer to serve as an operator on CyberShield engagements. You will execute adversary emulation operations end-to-end and help advance agentic, AI-driven red team operations by operating, evaluating, and improving autonomous and semi-autonomous agents that discover, chain, and exploit weaknesses.

You will work directly with customer security teams, collaborate with experienced engineers across MRT, and contribute the tradecraft, tooling, and operational judgment needed to improve how the team operates at scale.

Microsoft's mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

In alignment with our Microsoft values, we are committed to cultivating an inclusive work environment for all employees to positively impact our culture every day.

Responsibilities

• Execute CyberShield red team operations end-to-end, including initial access, privilege escalation, lateral movement and pivoting, persistence, objective completion, and reporting, against Microsoft's own environment and select external customer environments, using real-world adversary tactics, techniques, and procedures to validate detection, investigation, and response.
• Develop custom tooling, implants, and tradecraft to evade modern defenses and emulate the capabilities of advanced adversaries.
• Conduct agentic red team operations using AI agents for reconnaissance, vulnerability discovery, exploitation, and post-exploitation, while applying appropriate guardrails, oversight, and human-in-the-loop controls.
• Discover and exploit vulnerabilities across application, cloud, identity, network, hardware, and operational security layers, chaining findings into realistic attack paths that demonstrate business impact.
• Work directly with customers during engagements, communicating technical findings clearly and building trusted relationships with customer security teams.
• Prototype and improve tools, agents, and techniques that scale offensive emulation and vulnerability discovery, and provide feedback to our offensive AI platform engineering team based on experience in real environments.
• Collaborate with Blue Teams, GHOST, MSTIC, and internal Microsoft service teams to convert findings into product hardening and improved defender readiness.
• Contribute to operational standards, playbooks, and tradecraft for CyberShield engagements, and share expertise with other operators and specialists across MRT.
• Advocate for security change across Microsoft and its customers by building partnerships and clearly communicating the impact of risk.
• Embody our Culture and Values.

Qualifications

• Required Qualifications: Master's Degree in Statistics, Mathematics, Computer Science, or related field AND 3+ years experience in security or related field
• OR Bachelor's Degree in Statistics, Mathematics, Computer Science, or related field AND 4+ years experience in security or related field
• OR equivalent experience.

Other Requirements:

Citizenship & Citizenship Verification:

This role will require access to information that is controlled for export under export control regulations, potentially under the U.S. International Traffic in Arms Regulations or Export Administration Regulations, the EU Dual Use Regulation, and/or other export control regulations. As a condition of employment, the successful candidate will be required to provide either proof of their country of citizenship or proof of their U.S. permanent residency or other protected status (e.g., under 8 U.S.C.

1324b(a)(3)) for assessment of eligibility to access the export controlled information. To meet this legal requirement, and as a condition of employment, the successful candidate’s citizenship will be verified with a valid passport. Lawful permanent residents, refugees, and asylees may verify status using other documents, where applicable.

Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings:

Microsoft Cloud Background Check:

This position will be required to pass the Microsoft background and Microsoft Cloud background check upon hire/transfer and every two years thereafter.

Preferred Qualifications:

• 2+ years of experience executing red team or adversary emulation operations against enterprise or cloud environments.
• Hands-on experience using, building, or operating AI-driven or agentic offensive security tooling.
• Active U.S. Government TS//SCI clearance with full-scope polygraph is preferred, enabling immediate work with highly sensitive customer environments.
• 4+ years of experience identifying and exploiting security vulnerabilities across cloud (Azure, AWS, GCP), identity (Entra ID / Active Directory), Windows and Linux endpoints, network, or hardware.
• Experience with autonomous or agentic systems using large language models, including tool use, orchestration, evaluation, or safety guardrails applied to offensive security.
• 2+ years of experience with coding or scripting in languages such as Python, C#, C++, Go, PowerShell, .NET, Rust, or other comparable programming languages, including experience developing or modifying offensive tooling.
• Experience working directly with customers or partners and communicating technical security findings to technical and non-technical audiences.
• Blue team, detection engineering, or incident response experience and an understanding of how defenders detect and respond to adversary activity.
• Familiarity with MITRE ATT&CK, threat-informed defense, and regulated red team frameworks such as TIBER-EU, CBEST, or DORA.
• Contributions to the security community through research, open-source tooling, conference presentations, vulnerability disclosures, or similar work.

Penetration Testing IC4 - The typical base pay range for this role across the U.S. is USD $119,800 - $234,700 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $160,200 - $261,000 per year.

Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here: https://careers.microsoft.com/us/en/us-corporate-pay

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.