OverviewAs a Principal Security Architect in Microsoft Red Team Engineering, you will serve as the "blue team to the Red Team." You will set technical direction and deliver critical capabilities that make Red Team operations observable, secure, reliable, and safely distinguishable from real attacks at scale. This is a Principal individual-contributor role focused on the telemetry, detections, monitoring, deconfliction, and operational infrastructure surrounding Red Team engagements, rather than on executing the engagements themselves.
You will work at the intersection of offense and defense, partnering closely with Red Team operators, software engineers, detection engineers, security researchers, threat intelligence, incident response, and platform and telemetry teams across Microsoft. As a peer to Red Team operators, you will define what effective visibility looks like for adversarial operations, drive the right telemetry into centralized monitoring, and design and implement detections that distinguish authorized operations from real attacks using the same tradecraft.
You will shape the architecture and strategy for Red Team telemetry, monitoring, detection, alerting, deconfliction, and operational security, while working with engineers and partner teams to turn that strategy into durable production capabilities. The role requires deep security expertise, strong software and systems engineering judgment, and the ability to move between architecture and implementation, solve ambiguous cross-organization problems, and enable others to deliver at greater scale.
Responsibilities• Define and drive the technical strategy and architecture for Red Team visibility, telemetry, detection, deconfliction, and operational security.
• Use live Red Team operations, security incidents, threat intelligence, and adversary activity to identify systemic visibility and control gaps and translate them into prioritized engineering investments.
• Architect and build scalable services and data pipelines that collect, normalize, enrich, and correlate Red Team telemetry to make the right signals available to defenders.
• Drive the development of monitoring, hunting, detection, and alerting capabilities that help contextualize Red Team activity, identify unexpected or unauthorized behavior, and distinguish authorized operations from genuine adversary activity.
• Build durable deconfliction capabilities that combine operational context, asset and identity information, infrastructure signals, and behavioral telemetry while protecting sensitive Red Team information.
• Own and evolve the authoritative inventory of Red Team operational assets, ensuring infrastructure, tooling, identities, and related metadata are accurate, automated, auditable, and usable by monitoring and deconfliction systems.
• Raise the engineering bar across Red Team systems through strong patterns for testing, reliability, observability, secure development, deployment, and infrastructure lifecycle management.
• Provide hands-on technical leadership through architecture, implementation, reviews, debugging, operational response, and mentorship, while influencing engineering teams and roadmaps across Microsoft.
• Help ensure Microsoft can conduct authentic Red Team operations with strong visibility, control, and confidence in its defensive response.
QualificationsRequired/minimum qualifications- Bachelor's Degree in Computer Science or related technical field AND 6+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python OR equivalent experience.
Other Requirements- Ability to meet Microsoft, customer, and/or government security screening requirements is required for this role. These requirements include, but are not limited to the following specialized security screenings:
- Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud Background Check upon hire/transfer and every two years thereafter.
Additional or preferred qualifications- Master's Degree in Computer Science or related technical field AND 8+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python OR Bachelor's Degree in Computer Science or related technical field AND 12+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python OR equivalent experience.
- Experience in cybersecurity, including one or more areas such as security telemetry, detection engineering, security monitoring, incident response, threat analytics, cloud security, identity security, endpoint security, or offensive security infrastructure.
- Experience designing distributed services, data pipelines, automation, or large-scale security platforms.
- Demonstrated ability to set technical direction in ambiguous problem spaces, identify systemic risks, and translate complex security challenges into durable engineering solutions.
- Proven ability to influence architecture, priorities, and execution across multiple teams and organizations, and to communicate effectively with engineers, security practitioners, and senior technical leaders.
Software Engineering IC5 - The typical base pay range for this role across the U.S. is USD $142,800 - $274,800 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $188,000 - $304,200 per year.
Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
https://careers.microsoft.com/us/en/us-corporate-pay
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.
