Principal Security Engineer - Windows Security

About the role

The Microsoft Windows Security team is looking for security engineers who will help secure Windows products and devices, with a focus on offensive security and security engineering and mitigations. The team secures the Windows client and server operating systems, performing security design reviews, code reviews, penetration testing, vulnerability research and driving systematic mitigations. This Principal Security Engineer role is hands-on and technically demanding, involving uncovering novel attack vectors, developing proof-of-concept mitigations and partnering with Windows product engineering teams.

Key responsibilities

• Build reusable agents and tools to speed up and improve the consistency and quality of security reviews.
• Review features and code for security defects and architectural risk using your own and others' automated tools.
• Act as the security contact for teams building new products and technologies for the next version of Windows and devices.
• Identify security vulnerabilities in key OS features such as network protocols, security features and Microsoft devices, and devise new protections.
• Interact with the external security community and security researchers.
• Collaborate with product teams to improve security and articulate the business value of security investments.

Required profile

• Master's degree in Statistics, Mathematics, Computer Science or a related field with 4+ years of security or related experience, or a Bachelor's degree with 6+ years of such experience, or equivalent experience.
• Preferred: 2+ years identifying vulnerabilities in operating systems and/or native (C/C++) applications.
• Preferred: 5+ years in software engineering or security-related engineering.
• Preferred: demonstrated experience in security research, especially vulnerability discovery, and experience exploiting bugs and bypassing security mitigations.

Required skills

• Hands-on experience with native code (C/C++)
• Penetration testing: code audits, writing fuzzers, breaking assumptions
• Clear understanding of OS security fundamentals and computer science skills
• Familiarity with Microsoft Windows architecture