Principal Security Operations Engineer

Microsoft

Confirmed live yesterday High trust

Quick summary

Work type: On-site
Location: Redmond, WA
Salary: $142,800–$274,800 / yr
Posted: 13 days ago
Freshness: Confirmed live yesterday
Closes: Feb 25, 2027
Nearby: 99+ roles within 25 mi

Market check

Salary context

Above market

How this pay compares to similar roles

Similar $181k

This role $209k

$114k most similar roles pay here $292k

This role pays more than 75% of similar roles. Most pay $152,625–$208,975 — the shaded band above. At the midpoint, this role pays about $209k versus about $181k for comparable roles.

Based on 240 similar postings.

Employer

About Microsoft

Microsoft Corporation is a global technology leader producing software, hardware, and cloud services including Windows, Office 365, Azure cloud platform, Xbox gaming, and Surface devices. Industry: Software & Cloud Computing

Microsoft currently has 598 open roles on FindRole.

Listed pay typically runs $119,800–$234,700 across 586 roles with salary data.

Most-posted roles

View all roles at Microsoft

At a glance

TL;DR · Principal Security Operations Engineer

Role Posting Log in to save

Principal Security Operations Engineer As part of the Quantum Security & IT Operations team, the Principal Security Operations Engineer manages the end-to-end response to cybersecurity, insider, and external threat incidents affecting Microsoft Quantum. This role involves performing technical investigations, containment, root-cause analysis, and coordinating with legal, HR, and trade organizations to ensure secure resolution. The engineer will also define requirements for an AI-enabled Security Operations Center, focusing on signal enrichment, triage, and automated response while maintaining strict auditability. Key responsibilities include designing and tuning detections in Microsoft Sentinel using KQL, onboarding data streams, and identifying visibility gaps. The role addresses the complex challenge of protecting advanced computing platforms and intellectual property from sophisticated targeting. Required skills include experience in SIEM, threat modeling, and incident response, with a focus on securing high-stakes research programs within regulated environments.

Skills

Microsoft Sentinel KQL SIEM Incident Response Threat Modeling Anomaly Detection Cybersecurity Insider Threat LLM AI Post-Quantum Cryptography Purview DTEX Proofpoint ITM Magnet Axiom Forcepoint HPC

What you'll do

Manage end-to-end cybersecurity incident response for Microsoft Quantum, including detection, containment, recovery, and root-cause analysis.
Conduct forensic investigations into insider and external threats to produce defensible narratives for legal and executive review.
Define requirements and architecture for an AI-enabled Security Operations Center (SOC) to enhance triage and investigation.
Translate AI SOC needs into measurable capabilities while ensuring strict auditability and data-handling controls.
Design, implement, and tune security detections and data onboarding within Microsoft Sentinel and related platforms.
Lead cross-functional coordination with legal, HR, and national security teams to resolve complex incidents.
Convert incident findings into improved detection rules, runbooks, and long-term infrastructure enhancements.

What we're looking for

A Doctorate, Master's, or Bachelor's degree in Statistics, Mathematics, Computer Science, or a related field is required.
Candidates must have 3, 4, or 6 years of experience depending on their level of education.
Candidates must be able to pass the Microsoft Cloud Background Check every two years.
Applicants must provide proof of citizenship, U.S. permanent residency, or other protected status for export control compliance.
Experience in cybersecurity, security operations, incident response, insider threat, and SIEM is required.
Hands-on experience with Microsoft Sentinel (KQL) or an equivalent enterprise SIEM platform is required.
Preferred certifications include CISSP, CISA, CISM, SANS, OSCP, or Security+.
Experience designing or evaluating agentic AI or LLM-based automation in a security operations context is strongly desired.

Save