New

Principal Security Assurance Engineer

Microsoft
United States, Washington, Redmond
Mar 24, 2026
Overview The Cloud & AI organization accelerates Microsoft's mission and bold ambitions to ensure that our company and industry is securing digital technology platforms, devices, and clouds in our customers' heterogeneous environments, as well as ensuring the security of our own internal estate. Our culture is centered on embracing a growth mindset, a theme of inspiring excellence, and encouraging teams and leaders to bring their best each day. In doing so, we create life-changing innovations that impact billions of lives around the world. Microsoft is one of the largest enterprise service companies in the world. The MicrosoftSecurityAnalysis & Fix Engineering (SAFE) team is dedicated to building and leveraging the world's most advanced static analysis platform to rapidly and accurately identify security weaknesses across the billions of lines of source code that go into Microsoft's products and services, empower efficient and effective corrective action by both developers and LLMs, and build complementary analysis capabilities to enable more effectively perform proactive secure development across the entirety of Microsoft. Our ambition is to make it effortless to elevate and keep billions of lines of code at themost cuttingedge of security understanding. We are looking for a passionate and innovativePrincipal Security Engineerto join our highly collaborative team to help leverage our existing analysis capabilities,research and build detections to identify new security weaknesses across Microsoft products, as well as to help push the envelope of what can be detected through the development of novel analysis capabilities. The ideal candidate straddles the line of security engineer and software developer, with a deep understanding of the semantics of one or more programming languages coupled with expansive understanding of security vulnerabilities in one or more domains (Web, System, LLM/GenAI, etc.), with a strong collaborative instinct to both elevate others with their expertise, while also being elevated by others' expertise. Microsoft's mission is to empower every person and every organization on the planet to achieve more. Asemployeeswe come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond. In alignment with our Microsoft values, we are committed to cultivating an inclusive work environment for all employees to positivelyimpactour culture every day. Responsibilities Investigate code vulnerabilities and generalize code patterns for detections Create static code analysis rules and expressions for finding vulnerable code patterns Apply static code analysis andvalidateresults manually and using automation Improve tooling used in static code analysis and results processing Assistwith active incident research, detection,mitigationand post-incident response Embody ourcultureandvalues Qualifications RequiredQualifications Master's Degree in Statistics, Mathematics, Computer Science, Risk Management, Cyber Security,orrelated field AND 4+ yearsofexperience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detectionORBachelor's Degree in Statistics, Mathematics, Computer Science, Risk Management, Cyber Security,orrelated field AND 6+ yearsofexperience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detectionORequivalent experience. Other Requirements: Abilityto meet Microsoft,customerand/or government security screening requirements arerequiredfor this role. These requirements include, but are not limited to the following specialized security screenings: Microsoft CloudBackgroundCheck:This position will berequiredto pass the Microsoftbackgroundand Microsoft Cloudbackgroundcheckupon hire/transfer and every two years thereafter. Preferred Qualifications: 5+ years of experience with 2 or more programming languages (e.g.C++, C#, Java, JavaScript, TypeScript, VBScript, Go, Ruby, Python, Rust, Swift,Powershell, PHP, SQL, etc.). Should have a firm grasp ofthe languagesemantics and behavior. 1+ years of experience using a query language (SQL, Linq, Splunk, Kusto,etc). 3+ years of experience with one or more areas of security from an AppSec standpoint,e.g.OS/System security, network and cloud security,webor mobile application security, etc. 3+ years of experience performing security code reviews 1+ years of experience with Regular Expressions 3+ years of experience working with cloud services and microservice architecture (preferably with Azure) Familiarity with .NET CLI (IL, bytecode), Java Bytecode, x86 or ARM ASM, orothercompliabletarget Experience applying AI and LLM, and especially experience understanding how LLMs function #CodeQL, #AST, #.NET, #StaticCodeAnalysis, #SemGrep, #Security, #Cloud, #AI, #cybersecurity, #codeanalysis Security Assurance IC4 - The typical base pay range for this role across Canada is CAD $114,400 - CAD $203,900 per year. Find additional pay information here: https://careers.microsoft.com/v2/global/en/canada-pay-information.html Security Assurance IC4 - L'echelle salariale de base typique pour ce role dans l'ensemble du Canada est de 114,400 $ CAD a 203,900 $ CAD par annee. Pour plus d'information au sujet de la remuneration, veuillez cliquer ici: https://careers.microsoft.com/v2/global/en/canada-pay-information.html Ce poste sera ouvert pendant au moins cinq jours et les candidatures seront acceptees de facon continue jusqu'a ce que le poste soit pourvu. This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled. Microsoft est un employeur offrant l'egalite d'acces a l'emploi. Tous les candidats qualifies seront pris en consideration pour l'emploi, sans egard a l'age, a l'ascendance, a la citoyennete, a la couleur, aux conges medicaux ou familiaux, a l'identite ou a l'expression de genre, aux renseignements genetiques, a l'etat d'immigration, a l'etat matrimonial, a l'etat de sante, a l'origine nationale, a un eventuel handicap physique ou mental, a l'affiliation politique, au statut de veteran protege ou au statut militaire, a la race, a l'ethnie, a la religion, au sexe (y compris la grossesse), a l'orientation sexuelle ou a toute autre caracteristique protegee par les lois, ordonnances et reglements locaux applicables. Si vous avez besoin d'aide avec des accommodements religieux et/ou d'un accommodement raisonnable en raison d'un handicap pendant le processus de candidature, apprenez-en plus sur la demande d'accommodement. Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.