below marketmost similar roles pay hereabove market
This role pays more than
70%
of similar roles. Most pay
$156,200–$214,621
— the blue band above.
At the midpoint, this role pays about
$209k
versus about
$185k
for comparable roles.
Based on 240 similar postings.
Employer
About Microsoft
Microsoft Corporation is a global technology leader producing software, hardware, and cloud services including Windows, Office 365, Azure cloud platform, Xbox gaming, and Surface devices. Industry: Software & Cloud Computing
Microsoft currently has
694 open roles
on FindRole.
Listed pay typically runs
$119,800–$234,700
across 651 roles with salary data.
The Principal Security Researcher joins the MDASH team to build and improve an AI-powered, agentic system designed for automated vulnerability discovery, validation, and resolution in source code. You will conduct hands-on research across various vulnerability classes, languages, and frameworks to identify security weaknesses, assess reachability, and evaluate remediation correctness. Daily tasks include building research prototypes, fuzzing harnesses, and datasets while analyzing missed findings to improve model configurations and analysis methods. You will utilize techniques such as manual code review, static analysis, dynamic analysis, debugging, reverse engineering, symbolic execution, and taint analysis. The role requires deep knowledge of memory corruption, injection, and cryptography. You will translate research insights into measurable improvements for agents and tools, ultimately helping organizations resolve vulnerabilities within complex software ecosystems.
Conduct hands-on vulnerability research to discover, validate, and assess the reachability of security flaws across various languages and frameworks.
Translate research insights into implemented improvements for AI agents, model configurations, and automated analysis methods.
Identify evaluation targets and author trusted ground truth for vulnerability evidence, attack paths, and remediation.
Run evaluations to uncover patterns in missed results and create adversarial cases to improve system capabilities.
Build research prototypes, fuzzing harnesses, datasets, and automation tools to accelerate capability improvements.
Lead complex security investigations and mentor other researchers to raise the quality of vulnerability research and implementation.
Analyze missed and incorrect findings to develop improvements that measurably increase recall, precision, and fix quality.
What we're looking for
Master's degree in a relevant field and 4+ years of experience, or a Bachelor's degree and 6+ years of experience, or equivalent experience.
Ability to pass Microsoft and Microsoft Cloud background checks.
8+ years of experience in vulnerability research, application security, offensive security, or secure software development (preferred).
Demonstrated hands-on experience discovering, reproducing, and validating software vulnerabilities and assessing reachability and exploitability (preferred).
Experience with fuzzing and at least one other technique like manual code review, static analysis, or reverse engineering (preferred).
Proficiency developing security research tooling or automation in one or more programming languages (preferred).
Experience building and improving AI agents or agentic systems using large language models (preferred).
Experience analyzing vulnerabilities across multiple programming languages including C/C++, C#, Java, JavaScript, and Python (preferred).
DevSecOps
AI Security
Penetration Testing
Ruby
Go
Python
TypeScript
Rust
AI Frameworks
Distributed Systems
GitLab
Prompt Injection
Agent Manipulation
Security Research
Vulnerability Research
Offensive Security
Exploit Development
Reverse Engineering
AI
Threat Analysis
Anomaly Detection
Software Development Lifecycle
Large-scale Computing
Capture The Flag (CTF)
Vulnerability Research
Offensive Security
Exploit Development
Reverse Engineering
AI
Threat Analysis
Anomaly Detection
Software Development Lifecycle
Cybersecurity
Capture The Flag (CTF)
Machine Learning
Large Language Models
Cybersecurity
Reverse Engineering
Big Data Pipelines
Deep Learning
Anomaly Detection
Threat Hunting
Software Development Lifecycle
Root-Cause Analysis
Vulnerability Research