Principal Security Operations Engineer

Job Description

Job Title: Principal Security Operations Engineer. Location: Redmond, Washington, USA
Job Type: Full-Time, Entry Level. Work Arrangement: On-site, 3 days per week in-office

Responsibilities:

• Own cybersecurity incidents affecting Microsoft Quantum, including severity assessment, response strategy, technical investigation, containment, recovery, root-cause analysis, and accountable closure.
• Manage insider and external threat incidents from initial indicators through scoping, forensic review, evidence preservation, case disposition, and root-cause analysis.
• Produce defensible investigative narratives for executive, legal, and compliance review.
• Lead cross-functional incident response with Quantum engineering, Microsoft's CISO organization, National Security Team, HR, Legal, and Global Trade teams.
• Provide concise executive updates, document decisions and evidence, and ensure post-incident actions are assigned and completed.
• Drive improvements to systems and processes based on incident and risk learnings that affect multiple teams;
• Define and drive the requirements, architecture, operating model, and prioritized engineering backlog for an AI-enabled QSIT Security Operations Center (SOC).
• Shape how AI supports signal enrichment, triage, investigation, response recommendations, and analyst decision-making while maintaining auditability and appropriate sensitive-data handling.
• Translate AI-enabled SOC requirements into measurable capabilities and acceptance criteria.
• Evaluate first-party and third-party security solutions, guide implementation, and assess operational effectiveness, risk, and production readiness.
• Design, implement, and tune insider-threat and cybersecurity detections in Microsoft Sentinel and related platforms.
• Onboard and normalize new security data streams and identify visibility gaps.
• Convert incident findings into improved detections, security controls, runbooks, and monitoring coverage.
• Work independently and provide technical leadership in ambiguous, high-impact security situations.
• Collaborate across organizational boundaries to influence security strategy and improve protection of Microsoft Quantum's research environment.

Qualifications:

• Doctorate in Statistics, Mathematics, Computer Science, or a related field and 3+ years of experience in software development lifecycle, large-scale computing, threat modeling, cybersecurity, anomaly detection, SOC detection, threat analytics, SIEM, IT, or operations incident response.
• OR Master's Degree in Statistics, Mathematics, Computer Science, or a related field and 4+ years of relevant experience.
• OR Bachelor's Degree in Statistics, Mathematics, Computer Science, or a related field and 6+ years of relevant experience.
• Equivalent experience may also be considered;
• Ability to meet Microsoft, customer, and/or government security screening requirements.
• Ability to pass the Microsoft Cloud Background Check upon hire or transfer and every two years thereafter.
• Ability to meet applicable citizenship or protected-status verification requirements for access to export-controlled information.

Preferred:

• Doctorate in Statistics, Mathematics, Computer Science, or a related field and 5+ years of relevant experience.
• OR Master's Degree in Statistics, Mathematics, Computer Science, or a related field and 8+ years of relevant experience.
• OR Bachelor's Degree in Statistics, Mathematics, Computer Science, or a related field and 12+ years of relevant experience.
• Equivalent experience may also be considered.
• 6+ years of experience in cybersecurity, security operations, incident response, insider threat, threat analytics, SIEM, or equivalent areas.
• Demonstrated experience leading complex security incidents end-to-end, including investigation, containment, recovery, root-cause analysis, executive communication, and post-incident remediation.
• Hands-on experience with Microsoft Sentinel and KQL or an equivalent enterprise SIEM.
• Experience with detection engineering, security-data onboarding, and investigative analysis.
• Ability to establish technical direction during ambiguous and high-impact security situations;
• CISSP, CISA, CISM, SANS GCIA, GCIH, OSCP, Security+, or another relevant certification.
• Experience collaborating with insider-threat, investigations, legal, or trade-compliance functions.
• Exposure to insider-threat platforms such as Purview, DTEX, Proofpoint ITM, Magnet Axiom, or Forcepoint.
• Experience designing, deploying, or evaluating agentic AI or LLM-based automation for security operations.
• Familiarity with post-quantum cryptography concepts and CNSA 2.0.
• Experience or interest in protecting strategic research programs from sustained external targeting.
• Familiarity with export-control requirements, including EAR and ITAR, and government program environments.

Benefits and Compensation:

• Typical U.S. base salary range: $142,800 to $274,800 per year.
• San Francisco Bay Area and New York City metropolitan area salary range: $188,000 to $304,200 per year.
• Certain roles may be eligible for additional benefits and compensation.
• Healthcare, financial, paid leave, learning, and other employee benefits may be available according to Microsoft's applicable benefits programs.

Other Information:

• This is an Individual Contributor position at Security Operations Engineering IC5 level.
• The position requires working on-site in Redmond, Washington, with 3 days per week in-office.
• Travel is expected at 25% to 50%.
• The position does not specify a fixed closing date and applications are accepted on an ongoing basis until the role is filled, with the position open for a minimum of 5 days.
• Microsoft is an equal opportunity employer;
• Qualified applicants are considered without regard to protected characteristics under applicable law.
• Microsoft may use AI technology provided by Eightfold to support parts of the recruitment process. Microsoft applies human oversight and judgment.
• Candidates requiring accommodations during the application process can request appropriate assistance.
• The role may involve access to export-controlled information, requiring applicable citizenship, permanent residency, or other protected-status verification.