2 days ago
Base Salary
$143k - $304k/yr
Responsibilities
- Own the security architecture, technical strategy, implementation, rollout, and operation of foundational COSMIC security services across globally distributed infrastructure.
- Design and build highly available certificate lifecycle systems covering enrollment, issuance, delivery, validation, renewal, revocation, trust distribution, and CA rotation.
- Build resilient key and secrets management capabilities with KMS integration, encryption at rest, key-version transitions, reconciliation, auditability, and emergency recovery.
- Advance workload identity, managed identities, isolation, mutual TLS, least-privilege RBAC, policy enforcement, and secure secret delivery for Kubernetes and cloud-native infrastructure.
- Lead trust and issuer-change readiness, cryptographic agility, compatibility validation, migration guidance, and uninterrupted fleet availability across public and sovereign environments.
- Threat model distributed systems, investigate privilege boundaries, and translate findings into secure-by-default APIs, guardrails, enforcement points, and remediation plans.
- Establish security invariants, service-level objectives, inventories, expiry alerts, telemetry, detection, audit, and post-change validation.
- Lead production readiness and operations through ring-based deployment, feature gating, failure testing, rollback, blast-radius containment, incident response, and on-call practices.
- Drive end-to-end security features across control planes, provisioning, agents, controllers, Kubernetes custom resources, authorization, and workload consumption paths.
- Lead cross-team architecture and execution, contribute production code and design documents, and mentor engineers in security and distributed-systems practices.
Requirements
- Bachelor’s degree in Computer Science or a related technical field and 6+ years of technical engineering experience with coding, or equivalent experience.
- Ability to pass Microsoft Cloud Background Check and other applicable Microsoft, customer, or government security screenings.
- Preferred: master’s degree with 8+ years of experience, or bachelor’s degree with 12+ years of experience, or equivalent experience.
- Preferred: 3+ years designing, building, or operating security-critical software or infrastructure involving PKI, certificates, cryptographic key management, secrets management, identity, authentication, or authorization.
- Experience designing and operating highly available, reliable, observable distributed systems or cloud services with incident-response requirements.
- Experience with X.509, certificate authorities, TLS/mTLS, cryptography, key management, HSMs, KMS, and workload identity systems.
- Expertise securing multi-tenant Kubernetes, distributed infrastructure, zero-trust architectures, workload isolation, and security policy enforcement.
- Ability to lead cross-team security initiatives, threat modeling, security reviews, incident investigations, operational risk management, stakeholder alignment, and engineer mentorship.
Benefits
- Typical U.S. base pay range is USD $142,800–$274,800 per year; certain San Francisco Bay Area and New York City metropolitan locations use a separate USD $188,000–$304,200 annual range.
- Certain roles may be eligible for benefits and other compensation; applications are accepted on an ongoing basis until the position is filled.
Tech Stack
Categories
About Microsoft
Microsoft develops operating systems, productivity software, cloud services, developer tools, and consumer devices for individuals, enterprises, and governments. Its main products include Windows, Microsoft 365, Azure, Visual Studio/GitHub, Xbox, and LinkedIn; revenue comes from software subscriptions and licenses, cloud consumption, hardware sales, and advertising. Founded in 1975 and headquartered in Redmond, Washington, Microsoft is a public company traded on Nasdaq.