Join a foundational team at Microsoft 365, focusing on Provisioning, Groups, and Manageability. This Principal Software Engineer role offers a unique opportunity to drive end-to-end security leadership across critical directory administration experiences.

You will collaborate closely with engineering teams to embed security into new features, modernization efforts, APIs, and operational processes, ensuring a "secure by design" approach. The position demands a blend of deep technical expertise in identity, authentication, authorization, privileged operations, API security, distributed systems, and threat modeling, coupled with the ability to influence architectural decisions across multiple teams.

Our strategy prioritizes customer trust, robust security, service hardening, least-privileged access, and minimizing dependencies on privileged operations. We are committed to empowering every person and organization on the planet to achieve more, fostering a culture of respect, integrity, accountability, and inclusion.

Take ownership of the security architecture and design principles for authentication, authorization, privileged operations, and least privilege access within Provisioning, Groups, and Manageability.

Review significant architectural changes, APIs, and modernization initiatives for potential security risks. Establish reusable security patterns and guardrails to promote consistent security practices across teams.

Identify and address systemic security risks that span multiple components, driving architectural solutions. Integrate security considerations early in the engineering design phase, moving beyond post-design reviews.

Lead threat modeling for major features and architectural shifts, clearly defining trust boundaries, attack surfaces, and potential privilege escalation paths. Work collaboratively across Provisioning, Groups, and Manageability, rather than focusing on a single component's security implementation. Partner with dedicated identity, authentication/authorization, and security organizations.

Contribute to the design and development of AI agents for Security and Compliance workflows, including compliance issue identification and resolution, evidence collection, secrets management, configuration enforcement, and work item triaging.

A Bachelor's Degree in Computer Science or a related technical field, combined with at least 6 years of technical engineering experience, including proficiency in languages like C, C++, C#, Java, JavaScript, or Python, is required. Equivalent experience will also be considered.

Preferred qualifications include a Bachelor's degree in Computer Science or a related technical field and 10+ years of technical engineering experience with coding in C, C++, C#, Java, JavaScript, or Python. Strong experience in designing and securing large-scale distributed/cloud services is highly valued.

Demonstrated deep understanding of identity, authentication, and authorization principles is essential. Candidates should possess a solid grasp of least privilege, defense in depth, trust boundaries, and secure-by-design methodologies. Experience in designing or reviewing service-to-service authentication and authorization, as well as working with application/service identities, certificates, credentials, and secrets, is beneficial.

Proven experience conducting threat modeling and architecture security reviews is a significant advantage. The ability to meet Microsoft, customer, and/or government security screening requirements, including a Microsoft Cloud Background Check, is mandatory for this role.