3 days ago
Base Salary
$120k - $261k/yr
Responsibilities
- Conduct hands-on vulnerability research across vulnerability classes, programming languages, frameworks, and codebase architectures.
- Discover, reproduce, validate, and assess the reachability and exploitability of vulnerabilities and the correctness of proposed fixes.
- Implement improvements to MDASH agents, tools, model configurations, and analysis methods based on research and evaluation findings.
- Create evaluation targets, trusted ground truth, adversarial cases, regression cases, and measurement systems for security capabilities.
- Build research prototypes, fuzzing harnesses, datasets, graders, and automation.
- Lead complex investigations, shape research direction, mentor researchers, and provide technical leadership.
- Collaborate with research, engineering, applied science, and product teams to communicate results and influence technical direction.
Requirements
- Bachelor's, Master's, or Doctorate degree in Computer Science, Computer Security, Computer Engineering, or a related field, or equivalent experience.
- At least 8 years of experience in vulnerability research, application security, offensive security, secure software development, program analysis, or related security work.
- Hands-on experience discovering, reproducing, and validating software vulnerabilities; assessing reachability and exploitability; and evaluating remediation correctness.
- Experience with fuzzing and at least one additional vulnerability research technique, such as manual code review, static analysis, dynamic analysis, debugging, reverse engineering, symbolic execution, taint analysis, or exploit development.
- Proficiency developing security research tooling or automation in one or more programming languages.
- Experience communicating complex technical findings through written reports, vulnerability analyses, or presentations.
- Deep knowledge of multiple vulnerability classes and exploitation patterns, including memory corruption, injection, authentication and authorization, cryptography, deserialization, path traversal, server-side request forgery, and business-logic flaws.
- Experience building fuzzing harnesses, custom mutators, sanitizers, coverage-guided fuzzing workflows, or large-scale fuzzing infrastructure.
- Experience analyzing vulnerabilities across multiple programming languages and ecosystems, including C/C++, C#, Java, JavaScript or TypeScript, Python, and cloud-native applications.
- Experience constructing security benchmarks, curating ground truth, measuring recall, precision, consistency, or remediation efficacy, and translating root-cause analysis into generalized improvements.
- Experience building and improving AI agents or agentic systems using large language models, including prompt and tool orchestration, model evaluation, automated grading, or reinforcement learning for security tasks.
- Experience with static application security testing, software composition analysis, SARIF, secure development lifecycle practices, or developer remediation workflows.
- A record of vulnerability disclosures, security advisories, CVEs, research publications, conference presentations, open-source security tools, or substantive security-community contributions.
- Ability to meet Microsoft, customer, and/or government security screening requirements, including the Microsoft background and Microsoft Cloud background checks.
Benefits
- Certain roles may be eligible for benefits and other compensation.
- The position requires passing the Microsoft background and Microsoft Cloud background checks upon hire or transfer and every two years thereafter.
- The position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until filled.
Tech Stack
Categories
About Microsoft
Microsoft develops operating systems, productivity software, cloud services, developer tools, and consumer devices for individuals, enterprises, and governments. Its main products include Windows, Microsoft 365, Azure, Visual Studio/GitHub, Xbox, and LinkedIn; revenue comes from software subscriptions and licenses, cloud consumption, hardware sales, and advertising. Founded in 1975 and headquartered in Redmond, Washington, Microsoft is a public company traded on Nasdaq.