Principal Security Researcher

Microsoft

Confirmed live yesterday High trust

Quick summary

Work type: On-site
Location: Redmond, WA
Salary: $142,800–$274,800 / yr
Posted: 37 days ago
Freshness: Confirmed live yesterday
Closes: Jan 31, 2027
Nearby: 99+ roles within 25 mi

Market check

Salary context

Above market

How this pay compares to similar roles

Similar $179k

This role $209k

$114k most similar roles pay here $292k

This role pays more than 78% of similar roles. Most pay $150,000–$208,800 — the shaded band above. At the midpoint, this role pays about $209k versus about $179k for comparable roles.

Based on 239 similar postings.

Employer

About Microsoft

Microsoft Corporation is a global technology leader producing software, hardware, and cloud services including Windows, Office 365, Azure cloud platform, Xbox gaming, and Surface devices. Industry: Software & Cloud Computing

Microsoft currently has 598 open roles on FindRole.

Listed pay typically runs $119,800–$234,700 across 586 roles with salary data.

Most-posted roles

View all roles at Microsoft

At a glance

TL;DR · Principal Security Researcher

Role Posting Log in to save

The Principal Security Researcher joins the MDASH team to build and improve an AI-powered, agentic system designed to discover, validate, and resolve vulnerabilities in source code. This role involves conducting hands-on research across various vulnerability classes, languages, and frameworks to assess reachability and exploitability while developing improvements for model configurations and analysis methods. The researcher will identify evaluation targets, author ground truth data, and build research prototypes including fuzzing harnesses, datasets, and automation tools. Key technical skills include proficiency in programming languages, experience with large language models, and expertise in techniques such as manual code review, static analysis, dynamic analysis, debugging, reverse engineering, symbolic execution, and taint analysis. The work focuses on the specific challenge of automating vulnerability discovery and providing developers with accurate remediation guidance within complex software ecosystems.

Skills

Vulnerability Research Large Language Models AI Agents Fuzzing Static Analysis Dynamic Analysis Reverse Engineering Symbolic Execution Taint Analysis C/C++ C# Java JavaScript TypeScript Python SARIF Threat Modeling

What you'll do

Conduct hands-on vulnerability research across various classes, languages, and architectures to discover and validate security flaws.
Assess the reachability, exploitability, and remediation correctness of identified vulnerabilities in source code.
Translate research insights into technical improvements for AI agents, tools, model configurations, and analysis methods.
Create high-quality ground truth data including attack paths, severity levels, and evidence for evaluation purposes.
Drive an eval-driven development loop by identifying patterns in errors and creating adversarial cases to improve system performance.
Build research prototypes, fuzzing harnesses, datasets, and automation tools to accelerate the capabilities of the MDASH system.
Provide technical leadership by shaping research direction and mentoring other researchers on complex investigations.

What we're looking for

Master's degree and 4+ years of experience in software development, cyber security, or related fields.
Bachelor's degree and 6+ years of experience in software development, cyber security, or related fields.
Ability to pass Microsoft background and Microsoft Cloud background checks.
8+ years of experience in vulnerability research, application security, offensive security, or secure software development.
Hands-on experience discovering, reproducing, and validating software vulnerabilities while assessing reachability and exploitability.
Experience with fuzzing and other techniques like manual code review, static/dynamic analysis, or reverse engineering.
Proficiency developing security research tooling or automation in one or more programming languages.
Experience building AI agents or agentic systems using large language models for security tasks.

Save