Principal Software Engineer

Overview

Cloud operations are entering a new era. COSMIC is building agentic infrastructure that helps engineers define goals, policies, and operational intent while autonomous systems safely execute routine work across Microsoft’s largest Kubernetes fleets.

Part of M365 Substrate Core, COSMIC is modernizing Microsoft’s compute platform with turn-key geo-presence, security, high availability, fault isolation, and automated cloud buildout—improving service agility, reliability, compliance, and cost efficiency.

We are seeking a Principal Security Software Engineer to define and build the security foundation for COSMIC’s high-scale infrastructure and autonomous operations.

You will lead the architecture and delivery of platform capabilities for public key infrastructure (PKI), certificate and key lifecycle management, workload identity, secrets protection, cryptographic agility, and secure service-to-service communication across globally distributed fleets. You will connect cloud control planes, Kubernetes controllers and custom resources, authorization systems, and workload consumption paths into secure end-to-end experiences.

You will design systems that make the secure path the default, automate rotation and recovery, minimize standing privilege, and remain safe and observable during failures, partial rollouts, migrations, and incidents.

Working across COSMIC, M365, and partner security organizations, you will turn ambiguous security and compliance requirements into durable platform architecture, establish engineering standards, drive multi-team execution, and raise the security capability of the broader organization through technical leadership and mentorship.

Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

Responsibilities

• Own the security architecture, technical strategy, implementation, rollout, and operation of foundational COSMIC security services across globally distributed, high-scale infrastructure.
• Design and build highly available certificate lifecycle systems, including enrollment, issuance, secure delivery, validation, renewal, revocation, expiry prevention, trust distribution, and root and intermediate CA rotation.
• Build resilient key and secrets management capabilities, including KMS integration, encryption at rest, key-version transitions, automated reconciliation and validation, hardware-backed protection where appropriate, auditability, and emergency recovery.
• Advance identity and authorization for multi-tenant Kubernetes and cloud-native infrastructure using workload identity, scoped managed identities, namespace and workload isolation, mutual TLS, least-privilege RBAC, policy enforcement, and secure secret delivery.
• Own trust and issuer-change readiness across public and sovereign environments, including cryptographic agility, operating-system and container trust behavior, compatibility validation, migration guidance, and uninterrupted fleet availability.
• Threat model complex distributed systems and investigate cross-tenant or cross-workload privilege boundaries; translate findings into secure-by-default APIs, platform guardrails, enforcement points, migration plans, and safely deployable remediation.
• Establish security invariants, service-level objectives, inventories, expiry alerts, telemetry, detection, audit, and post-change validation that continuously demonstrate the health and integrity of certificate, key, identity, and secrets systems.
• Lead production readiness and operations through ring-based deployment, feature gating, compatibility and failure testing, automated rollback, blast-radius containment, incident response, on-call excellence, troubleshooting guidance, and durable follow-up.
• Drive end-to-end security features across control planes, resource provisioning, agents and controllers, Kubernetes custom resources, cloud authorization, and workload consumption paths, with meaningful integration and regression testing.
• Lead cross-team architecture and execution across platform, identity, cloud infrastructure, security response, and partner engineering; clarify ownership boundaries, resolve long-range dependencies, contribute production code and design documents, and mentor engineers in security and distributed-systems practices.

Qualifications

• Required Qualifications: Bachelor's Degree in Computer Science or related technical field AND 6+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python
• OR equivalent experience.
• Other Requirements: Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include but are not limited to the following specialized security screenings:
• Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud background check upon hire/transfer and every two years thereafter.

Preferred Qualifications:

• Master's Degree in Computer Science or related technical field AND 8+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python
• OR Bachelor's Degree in Computer Science or related technical field AND 12+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python
• OR equivalent experience.
• 3+ years of experience designing, building, or operating security-critical software or infrastructure in areas such as PKI, certificates, cryptographic key management, secrets management, identity, authentication, or authorization.
• Experience designing and operating distributed systems or cloud services with high availability, reliability, observability, and incident-response requirements.
• Experience with X.509, certificate authorities, TLS/mTLS, cryptography, key management, HSMs, KMS, and workload identity systems.
• Expertise in securing multi-tenant Kubernetes, distributed infrastructure, zero-trust architectures, workload isolation, and security policy enforcement.
• Proven ability to lead cross-team security initiatives, including architecture, trust migrations, and production deployment while ensuring service availability.
• Proficient in threat-modeling, security review, incident investigation, and operational risk management skills, leveraging telemetry, audits, and automated controls.
• Ability to communicate complex security decisions clearly, influence senior stakeholders, build alignment across teams, and mentor engineers in security engineering practices.

Software Engineering IC5 - The typical base pay range for this role across the U.S. is USD $142,800 - $274,800 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $188,000 - $304,200 per year.

Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here: https://careers.microsoft.com/us/en/us-corporate-pay

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.