Starting January 26, 2026, Microsoft AI (MAI) employees who live within a 50- mile commute of a designated Microsoft office in the U.S. or 25-mile commute of a non-U.S., country-specific location are expected to work from the office at least four days per week. This expectation is subject to local law and may vary by jurisdiction.
Responsibilities
Identifies and conducts research into critical security areas of Microsoft, supported, and/or competitor products vulnerable to exploitation, current or potential future attacks, adversary tracking, and/or academic literature. Researches, analyzes, and summarizes security threats and shares results across teams to incorporate into future research or as enhancements in alignment with security initiatives. Partners cross-functionally (e.g., across disciplines, teams, security versus non-security) to design solutions to prevent, detect, and/or disrupt attacks, including for integration in or addition to new/existing products or features. Leverages artificial intelligence (AI) workflows to understand research operations and how customers use Microsoft products and identifies opportunities for solutions to deliver protection. Creates security analysis plan that aligns product timelines, interdependencies, risks, and feature scopes.
Leads large-scale security reviews, including architectural and design reviews, and synthesizes findings in analysis reports. Implements best practices for security architecture, design, and development across feature areas and teams. Evaluates security risks and impact to the affected services and partners with others to remove blockers and mitigate risks. Monitors and responds to security events, potential vulnerabilities, exposures, and policy compliance issues, escalating as needed.
Solves classes of issues in technical implementation and automation of solutions related to specific kinds of security issues (e.g., security posture, signature-based detection, malware, threat analysis, reverse engineering, attack disruption, anomaly detection). Works across disciplines to identify and develop improvements in solutions and methods.
Qualifications
Required Qualifications
Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field
OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
OR equivalent experience.
Preferred Qualifications
Doctorate in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
OR Master's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 6+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Computer Security, or related field AND 8+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection
OR equivalent experience.
Significant experience in areas such as
Vulnerability research and exploit analysis.
Code auditing and secure architecture review.
AI assisted Vulnerability Research.
Fuzzer development and crash triage.
Browser, application, operating system, or cloud security.
Threat modeling and attack surface analysis.
Security automation and AI-assisted security research.
Software engineering and computer science.
C/C++, Rust.
#AIX
#EdgeVR
#EdgeSecurity
Security Research IC4 - The typical base pay range for this role across the U.S. is USD $119,800 - $234,700 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $160,200 - $261,000 per year.
- Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
- https://careers.microsoft.com/us/en/us-corporate-pay
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.
Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.
