3 months ago
Base Salary
$143k - $304k/yr
Responsibilities
- Conduct hands-on vulnerability research across vulnerability classes, languages, frameworks, and codebase architectures.
- Discover and validate vulnerabilities, assess reachability and exploitability, and evaluate whether fixes correctly address underlying weaknesses.
- Implement and measure improvements to MDASH agents, tools, model configurations, and analysis methods.
- Create evaluation targets, trusted ground truth, adversarial cases, regression cases, benchmarks, and automated graders.
- Build research prototypes, fuzzing harnesses, datasets, and automation for capability improvement.
- Lead complex investigations, shape research direction, mentor researchers, and raise vulnerability research quality.
- Collaborate with research, engineering, applied science, and product teams to communicate results and influence technical direction.
Requirements
- A master's degree in Statistics, Mathematics, Computer Science, Risk Management, Cyber Security, or a related field plus 4+ years of relevant experience, or a bachelor's degree in one of those fields plus 6+ years of relevant experience, or equivalent experience.
- Ability to meet Microsoft, customer, and/or government security screening requirements, including the Microsoft Cloud Background Check.
- 8+ years of experience in vulnerability research, application security, offensive security, secure software development, program analysis, or related security work is preferred.
- Hands-on experience discovering, reproducing, and validating software vulnerabilities; assessing reachability and exploitability; and evaluating remediation correctness.
- Experience with fuzzing and at least one additional technique such as manual code review, static analysis, dynamic analysis, debugging, reverse engineering, symbolic execution, taint analysis, or exploit development.
- Proficiency developing security research tooling or automation in one or more programming languages.
- Knowledge of multiple vulnerability classes and exploitation patterns, including memory corruption, injection, authentication and authorization, cryptography, deserialization, path traversal, server-side request forgery, and business-logic flaws.
- Experience building fuzzing harnesses, custom mutators, sanitizers, coverage-guided fuzzing workflows, or large-scale fuzzing infrastructure.
- Experience analyzing vulnerabilities across multiple programming languages and ecosystems, including C/C++, C#, Java, JavaScript or TypeScript, Python, and cloud-native applications.
- Experience constructing security benchmarks, curating ground truth, measuring evaluation metrics, and translating root-cause analysis into generalized improvements.
- Experience building and improving AI agents or agentic systems using large language models, including prompt and tool orchestration, model evaluation, automated grading, or reinforcement learning for security tasks.
- Experience with static application security testing, software composition analysis, SARIF, secure development lifecycle practices, or developer remediation workflows.
- A record of vulnerability disclosures, security advisories, CVEs, research publications, conference presentations, open-source security tools, or substantive security-community contributions.
Tech Stack
Categories
About Microsoft
Microsoft develops operating systems, productivity software, cloud services, developer tools, and consumer devices for individuals, enterprises, and governments. Its main products include Windows, Microsoft 365, Azure, Visual Studio/GitHub, Xbox, and LinkedIn; revenue comes from software subscriptions and licenses, cloud consumption, hardware sales, and advertising. Founded in 1975 and headquartered in Redmond, Washington, Microsoft is a public company traded on Nasdaq.