Principal Security Engineer

Overview

The Windows Security team at Microsoft is seeking a Principal Security Engineer dedicated to enhancing the security of Windows products and devices through offensive security tactics, detailed vulnerability research, and the creation of scalable mitigation strategies. This team safeguards Windows client and server operating systems deployed globally by customers and businesses.

The role involves discovering and analyzing complex security vulnerabilities and new attack methods within the Windows environment. Responsibilities include developing proof-of-concept exploit code, crafting robust mitigations to individual vulnerabilities as well as systematic security issues, and collaborating closely with engineering teams to embed strong security principles into product design and architecture.

Microsoft embraces a mission to empower every person and organization worldwide through innovation, respect, integrity, accountability, and fostering an inclusive workplace culture.

Key Responsibilities

• Perform comprehensive vulnerability research and offensive security assessments on Windows systems using manual code review, fuzz testing, penetration testing, and exploitation methods to identify security weaknesses and complex risks.
• Engage with security communities both internally and externally to stay informed on emerging vulnerabilities, attack methodologies, and potential improvements for Windows security posture.
• Conduct detailed analysis of product designs, features, and native (C/C++) code to uncover architectural and security risks utilizing both automated tools and manual techniques.
• Create proof-of-concept exploits and design reliable, scalable mitigations targeting both specific vulnerabilities and broader categories of security threats.
• Develop reusable security tooling and automation to boost the efficiency, consistency, and quality of vulnerability discovery and security review processes.
• Collaborate with Windows product engineering teams to integrate security considerations during product design and resolve outstanding vulnerabilities.

Qualifications

• Required: Master's degree in Statistics, Mathematics, Computer Science, or related field with at least 3 years of experience in security or related disciplines, or a Bachelor's degree with 4+ years, or equivalent experience.
• Practical experience with offensive security methods including penetration testing, vulnerability research, exploit development, and techniques to bypass operating system security controls.
• Proven ability to identify vulnerabilities within operating systems and native C/C++ applications.
• Preferred: Master's degree with 6+ years relevant experience or Bachelor's with 8+ years, or equivalent.
• Additional 5+ years in software engineering, security engineering, or related technical roles.
• Track record of security research focusing on vulnerability identification and exploitation.
• Experience bypassing security mitigations in operating systems is highly valued.
• Knowledge of Microsoft Windows architecture and internals is advantageous.

Compensation and Additional Information

The typical annual base salary for this role across Canada ranges from CAD $142,400 to $257,500.

This position remains open for at least five days, accepting applications on a rolling basis until filled.

Equal Opportunity Employment

Microsoft is an inclusive employer that provides equal opportunity without discrimination based on age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other protected category by applicable laws.

Applicants requiring religious or disability accommodations during the hiring process are encouraged to request support.