Principal Engineering Manager, Security Engineering

Description

The company is hiring a principal leader to build and run security engineering for the company, the group that develops and trains first-party models published and used across products such as Foundry, Copilot, Microsoft 365, and MDASH.

The work covers model development and serving, large-scale compute, shared infrastructure, engineering systems, identity, data, and productivity services, the full operational stack behind large-scale training, experimentation, and deployment.

The group moved from a research lab to a full production model factory within the last year.

The role suits someone who has built or substantially reshaped engineering-heavy security teams and wants to do it again.

You will turn the security strategy into a working team, hiring and developing engineers who build controls and make security status clear enough to guide organization-wide priorities, while also building tools and systems that help the business move faster and more safely.

You will run the roadmap, set up operating mechanisms, be the directly responsible individual for some key security metrics and deliverables, and stay close enough to architecture, code, telemetry, and incidents to unblock work yourself.

Responsibilities

• Build and lead a security engineering team of engineers, architects, and operators with depth across product and application security, cloud and platform security, identity, detection and response, security tooling, and other areas as the organization grows.
• Hire, onboard, coach, and retain these people, set clear objectives, give actionable feedback, manage performance openly, support career growth, and give senior engineers real chances to lead.
• With the Deputy CISO, decide the team's structure, roles, interfaces, and hiring order, and identify where the company needs its own owners, where central Microsoft teams provide leverage, and where a principal specialist is needed.
• Build a culture that rewards technical depth, operational ownership, clear writing, open disagreement, and lasting systems over repeated one-off fixes.
• Raise team capability through technical reviews, mentoring, incident learning, reusable patterns, documentation, and investment in engineering quality.
• Turn security strategy, threat intelligence, incidents, architecture risk, partner commitments, and business priorities into a focused roadmap with clear outcomes, owners, milestones, dependencies, and measures.
• Set up planning and execution routines that make priorities, capacity, commitments, risks, and blocked decisions visible without making engineers write status reports.
• With program management, track what the team owns, what partner teams own, and where a critical dependency has no funded owner. Escalate with evidence, options, and a specific decision request.
• Balance urgent risk reduction against long-term work on secure defaults, reference architectures, automated controls, detection, exposure analysis, identity systems, response tooling, and validation platforms.
• Use security and operational metrics to spot trends, focus on high-impact work, find gaps in measurement, and confirm that controls work as intended.
• Create a steady operating rhythm covering technical reviews, roadmap decisions, service health, incident readiness, corrective actions, hiring, and team development.
• Engage directly in architecture, threat models, design reviews, code, configuration, telemetry, and operational data. Help the team find important attack paths, weigh tradeoffs, and pick practical implementations.
• Contribute hands-on where it changes the result, such as building a prototype, reviewing or writing code, analyzing an incident, querying telemetry, testing a control, automating a repeated task, or pairing on a hard design.
• Lead ambiguous security engineering efforts from problem framing through implementation, adoption, validation, and measurement, making sure each one ends in a changed system or decision rather than only a finding.
• Help accountable owners in partner teams make risk-informed decisions about designs, exceptions, access changes, and launches. Offer practical alternatives and stay involved through the outcome instead of only approving or rejecting.
• Hold production engineering to a high bar: clear ownership, safe deployment and rollback, observability, service-health expectations, incident procedures, and evidence that critical controls reduce the intended risk.
• Use the tools, workflows, and AI-assisted security capabilities the team builds. If those systems are not yet useful or reliable enough for the team's own leaders, improve them before asking others to adopt them.
• Work with research, model, platform, infrastructure, developer experience, product, privacy, legal, and central security teams to protect the systems used for training, evaluation, experimentation, deployment, and model operations.
• Help build secure paths from research to repeatable production deployment, with practical controls for identities, secrets, data, workloads, administrative surfaces, software supply chain, shared infrastructure, and high-consequence operations.
• Help partner teams improve their security through paved paths, reference implementations, reusable libraries, telemetry requirements, automated validation, and hands-on engineering support, not review gates alone.
• Prepare for incidents involving compromised identities, token or workload identity misuse, data exfiltration, provider compromise, telemetry tampering, or compromise of model and training infrastructure.
• Feed threat intelligence, hunting, adversary simulation, and incident evidence into detection priorities, engineering roadmaps, and control improvements.
• Turn incidents, near misses, repeated exceptions, and partner friction into engineering priorities and system-level fixes.
• Build working relationships with the company leaders, Microsoft CISO teams, and platform owners before difficult launches, incidents, or priority calls arrive.
• Use existing Microsoft capabilities where they solve the problem, extend them where shared investment gives leverage, and build the company-specific capabilities where the mission needs a different control point or operating model.
• Communicate technical risk, execution status, staffing needs, tradeoffs, and recommendations clearly, separating measured facts, analysis, uncertainty, and recommendation.
• Report accurately, raise material risk and delivery problems early, and describe status plainly without overstating urgency or presenting setbacks as wins.
• Expect to build more than you inherit, since team boundaries, operating mechanisms, and the technical portfolio are still being shaped.
• Lead people as the core accountability, and show impact through technical work you ship alongside the team.
• Turn executive strategy and technical depth into team output, complementing the Deputy CISO and senior engineers with priorities, ownership, staffing, quality, and operating discipline.
• Work on the systems behind frontier models, including technology used to develop, train, evaluate, and operate them.
• Work closely with the company platform and infrastructure leadership, the Deputy CISO, and Microsoft CISO leadership.
• Measure success by whether researchers and engineers have safer, repeatable ways to move quickly, not by gates you run.

Requirements

• A bachelor's degree in computer science, information technology, a related engineering field, data science, or cybersecurity, plus 6+ years of technical experience in software, network, service, or systems engineering, or industrial controls, or equivalent experience.
• Preferred: a master's degree in a related field plus 8+ years of such experience, or a bachelor's degree plus 12+ years, or equivalent experience. These are not pass/fail; candidates who meet some but not all are encouraged to apply.
• Preferred: 5+ years of technical experience with large-scale cloud or distributed systems.
• Preferred: direct experience managing software, infrastructure, or security engineers, including hiring, expectations, feedback, performance, and development.
• Preferred: experience defining or substantially reshaping an engineering team's structure, roles, hiring plan, or operating mechanisms.
• Preferred: recent hands-on experience writing code, reviewing architecture, analyzing telemetry, debugging production systems, or supporting complex incidents.
• Preferred: experience leading security engineering work from an ambiguous problem through implementation, production operation, and measurable improvement.
• Preferred: experience setting and executing a technical roadmap across organizational boundaries.
• Preferred: experience working with senior engineers and leaders on prioritization, staffing, architecture, launch, and risk decisions.
• Preferred: ability to explain technical risk, uncertainty, tradeoffs, decisions, and execution status to technical and non-technical audiences.
• Preferred: 3+ years of people management or informal or indirect team leadership.
• Preferred: 2+ years leading a security function such as security operations or threat and vulnerability management.
• Preferred: experience managing senior, staff, principal, or equivalent engineers, and managing engineering managers and technical leads.
• Preferred: experience scaling a security engineering team in a startup, research, rapidly growing, or otherwise incompletely defined environment.
• Preferred: experience securing AI or machine-learning systems, large-scale compute, cloud and platform infrastructure, identity systems, developer platforms, sensitive data systems, or high-value intellectual property.
• Preferred: experience building security platforms, automated controls, detection and response systems, exposure-management capabilities, secure frameworks, or developer-facing security tooling.

Conditions

Level: Service Engineering M5.

Typical base pay across the U.S. is USD $142,800 to $274,800 per year.

In the San Francisco Bay Area and New York City metropolitan area, base pay is USD $188,000 to $304,200 per year.

Some roles may be eligible for benefits and other compensation; details are provided separately.

The posting stays open for at least 5 days and accepts applications on an ongoing basis until filled.

The company is an equal opportunity employer.

Benefits

• Some roles may be eligible for benefits and other compensation.