The role of Principal and Senior Security Research Engineer focuses on building realistic attack scenarios across cloud, on-premises, and hybrid environments. The team aims to turn threat research into actionable scenarios that reproduce real vulnerabilities and adversary techniques. Candidates will work closely with threat researchers, AI engineers, and environment engineers to evaluate security capabilities and improve training signals. This position requires a strong background in software development and cybersecurity, along with a commitment to creating safe and effective research outcomes.

• Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
• Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
• Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 6+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection.
• 5+ years of experience researching vulnerabilities, conducting authorized offensive security tests, investigating security incidents, or developing security tools.
• 3+ years of experience developing and debugging security tools or scenario automation in Python, C#, Go, C/C++, or TypeScript.

• Turn threat research into working scenarios, reproducing real vulnerabilities and emerging adversary techniques in cloud, on-premises, and hybrid environments.
• Build realistic attack chains by connecting vulnerable applications, identity weaknesses, and misconfigurations into multi-step scenarios.
• Make outcomes verifiable by building automated graders and reward signals grounded in system state and telemetry.
• Evaluate beyond familiar patterns by creating attack variants, benign lookalikes, and patched controls.
• Deliver safe, reusable research by owning scenario code, isolation, evidence capture, and reset.

• Employees at Microsoft are often offered comprehensive, “world-class” benefits—including health and mental-wellness programs, competitive pay with bonuses and stock awards, and retirement/savings options. Time-off and flexibility are common, with generous vacation and holidays, parental and caregiver leave, and flexible work schedules, alongside learning support, employee resource groups, product discounts, and matching-gifts/volunteering programs. Specific benefits can vary by region.