Senior Security Engineer - Microsoft Red Team

Microsoft is hiring a Senior Security Engineer to serve as an operator on CyberShield red team engagements. The role executes end-to-end adversary emulation and advances agentic, AI-driven red teaming by operating and improving autonomous tools, working with customers, and sharing findings to strengthen security and defender readiness.

Responsibilities:

• Execute CyberShield red team operations end-to-end, including initial access, privilege escalation, lateral movement and pivoting, persistence, objective completion, and reporting, against Microsoft's own environment and select external customer environments, using real-world adversary tactics, techniques, and procedures to validate detection, investigation, and response
• Develop custom tooling, implants, and tradecraft to evade modern defenses and emulate the capabilities of advanced adversaries
• Conduct agentic red team operations using AI agents for reconnaissance, vulnerability discovery, exploitation, and post-exploitation, while applying appropriate guardrails, oversight, and human-in-the-loop controls
• Discover and exploit vulnerabilities across application, cloud, identity, network, hardware, and operational security layers, chaining findings into realistic attack paths that demonstrate business impact
• Work directly with customers during engagements, communicating technical findings clearly and building trusted relationships with customer security teams
• Prototype and improve tools, agents, and techniques that scale offensive emulation and vulnerability discovery, and provide feedback to our offensive AI platform engineering team based on experience in real environments
• Collaborate with Blue Teams, GHOST, MSTIC, and internal Microsoft service teams to convert findings into product hardening and improved defender readiness
• Contribute to operational standards, playbooks, and tradecraft for CyberShield engagements, and share expertise with other operators and specialists across MRT
• Advocate for security change across Microsoft and its customers by building partnerships and clearly communicating the impact of risk
• Embody our Culture and Values

Requirements:

• Master's Degree in Statistics, Mathematics, Computer Science, or related field AND 3+ years experience in security or related field
• Bachelor's Degree in Statistics, Mathematics, Computer Science, or related field AND 4+ years experience in security or related field
• equivalent experience
• Ability to meet Microsoft, customer and/or government security screening requirements are required for this role
• 2+ years of experience executing red team or adversary emulation operations against enterprise or cloud environments
• Hands-on experience using, building, or operating AI-driven or agentic offensive security tooling
• Active U.S. Government TS//SCI clearance with full-scope polygraph is preferred, enabling immediate work with highly sensitive customer environments
• 4+ years of experience identifying and exploiting security vulnerabilities across cloud (Azure, AWS, GCP), identity (Entra ID / Active Directory), Windows and Linux endpoints, network, or hardware
• Experience with autonomous or agentic systems using large language models, including tool use, orchestration, evaluation, or safety guardrails applied to offensive security
• 2+ years of experience with coding or scripting in languages such as Python, C#, C++, Go, PowerShell, .NET, Rust, or other comparable programming languages, including experience developing or modifying offensive tooling
• Experience working directly with customers or partners and communicating technical security findings to technical and non-technical audiences
• Blue team, detection engineering, or incident response experience and an understanding of how defenders detect and respond to adversary activity
• Familiarity with MITRE ATT&CK, threat-informed defense, and regulated red team frameworks such as TIBER-EU, CBEST, or DORA
• Contributions to the security community through research, open-source tooling, conference presentations, vulnerability disclosures, or similar work