3 days ago
Base Salary
$120k - $261k/yr
Responsibilities
- Proactively identify hidden and emerging risks by connecting data sources, telemetry, asset inventories, and business processes.
- Perform end-to-end AI penetration testing against AI systems, agents, copilots, connectors, and generative AI solutions.
- Research emerging threats including prompt injection, agent-to-agent trust abuse, tool and memory poisoning, and model supply chain risk.
- Develop automated detections, agent test cases, policies, tools, and procedures that scale penetration testing and risk hunting.
- Drive remediation with asset owners and track identified risks to closure.
- Translate technical findings into business impact and provide go, go-with-conditions, or no-go guidance.
- Produce risk reports, papers, presentations, and leadership trend readouts.
- Mentor Microsoft security practitioners and collaborate with other security teams on emerging threats.
Requirements
- Bachelor’s degree in computer science or a related technical field and 4+ years of technical engineering experience involving coding, or equivalent experience.
- Preferred qualifications include a master’s degree with 6+ years of experience, or a bachelor’s degree with 8+ years of experience, or equivalent experience.
- 5+ years of experience identifying security vulnerabilities, working with software development lifecycles, large-scale computing, modeling, cybersecurity, and anomaly detection.
- 5+ years of experience using penetration testing tools such as Kali Linux, Burp Suite, Nmap, and Nessus.
- 5+ years of experience with Python, C#, C/C++, or PowerShell.
- Experience analyzing large datasets and telemetry using tools or languages such as KQL/Kusto, SQL, or Python.
- Hands-on experience with AI and LLM security, including prompt injection, agent threat modeling, and the OWASP Top 10 for LLM Applications.
- Experience with threat hunting, risk assessment, detection engineering, and building automated detections.
- Familiarity with cloud and identity security, including Azure, Entra ID, app registrations, permissions, and asset inventory or posture management.
- Ability to connect technical findings to business and operational risk.
- Preferred penetration testing qualifications include GPEN/GXPN, GWAPT, OSCP/OSCE, or CRT/CCT/CCSAS.
- Preferred Microsoft Azure certifications include AZ-900 or AZ-500.
About Microsoft
Microsoft develops operating systems, productivity software, cloud services, developer tools, and consumer devices for individuals, enterprises, and governments. Its main products include Windows, Microsoft 365, Azure, Visual Studio/GitHub, Xbox, and LinkedIn; revenue comes from software subscriptions and licenses, cloud consumption, hardware sales, and advertising. Founded in 1975 and headquartered in Redmond, Washington, Microsoft is a public company traded on Nasdaq.