You will shape the architecture and strategy for Red Team telemetry, monitoring, detection, alerting, deconfliction, and operational security, while working with engineers and partner teams to turn that strategy into durable production capabilities. The role requires deep security expertise, strong software and systems engineering judgment, and the ability to move between architecture and implementation, solve ambiguous cross-organization problems, and enable others to deliver at greater scale.
Responsibilities
- Define and drive the technical strategy and architecture for Red Team visibility, telemetry, detection, deconfliction, and operational security.
- Use live Red Team operations, security incidents, threat intelligence, and adversary activity to identify systemic visibility and control gaps and translate them into prioritized engineering investments.
- Architect and build scalable services and data pipelines that collect, normalize, enrich, and correlate Red Team telemetry to make the right signals available to defenders.
- Drive the development of monitoring, hunting, detection, and alerting capabilities that help contextualize Red Team activity, identify unexpected or unauthorized behavior, and distinguish authorized operations from genuine adversary activity.
- Build durable deconfliction capabilities that combine operational context, asset and identity information, infrastructure signals, and behavioral telemetry while protecting sensitive Red Team information.
- Own and evolve the authoritative inventory of Red Team operational assets, ensuring infrastructure, tooling, identities, and related metadata are accurate, automated, auditable, and usable by monitoring and deconfliction systems.
- Raise the engineering bar across Red Team systems through strong patterns for testing, reliability, observability, secure development, deployment, and infrastructure lifecycle management.
- Provide hands-on technical leadership through architecture, implementation, reviews, debugging, operational response, and mentorship, while influencing engineering teams and roadmaps across Microsoft.
- Help ensure Microsoft can conduct authentic Red Team operations with strong visibility, control, and confidence in its defensive response.
Qualifications
Required/minimum qualifications
Bachelor's Degree in Computer Science or related technical field AND 6+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python OR equivalent experience.
Other Requirements
Ability to meet Microsoft, customer, and/or government security screening requirements is required for this role. These requirements include, but are not limited to the following specialized security screenings:
Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud Background Check upon hire/transfer and every two years thereafter.
Additional or preferred qualifications
Master's Degree in Computer Science or related technical field AND 8+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python OR Bachelor's Degree in Computer Science or related technical field AND 12+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python OR equivalent experience.
Experience in cybersecurity, including one or more areas such as security telemetry, detection engineering, security monitoring, incident response, threat analytics, cloud security, identity security, endpoint security, or offensive security infrastructure.
Experience designing distributed services, data pipelines, automation, or large-scale security platforms.
Demonstrated ability to set technical direction in ambiguous problem spaces, identify systemic risks, and translate complex security challenges into durable engineering solutions.
Proven ability to influence architecture, priorities, and execution across multiple teams and organizations, and to communicate effectively with engineers, security practitioners, and senior technical leaders.
Software Engineering IC5 - The typical base pay range for this role across the U.S. is USD $142,800 - $274,800 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $188,000 - $304,200 per year.
- Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
- https://careers.microsoft.com/us/en/us-corporate-pay
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.
Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.
