Senior Security Researcher and Principal Security Researcher

Microsoft

Confirmed live yesterday High trust

Quick summary

Work type: On-site
Location: Redmond, WA
Salary: $119,800–$234,700 / yr
Posted: 45 days ago
Freshness: Confirmed live yesterday
Closes: Jan 24, 2027
Nearby: 99+ roles within 25 mi

Market check

Salary context

Competitive pay

How this pay compares to similar roles

Similar $180k

This role $177k

$106k most similar roles pay here $248k

This role pays more than 56% of similar roles. Most pay $151,475–$208,800 — the shaded band above. At the midpoint, this role pays about $177k versus about $180k for comparable roles.

Based on 239 similar postings.

Employer

About Microsoft

Microsoft Corporation is a global technology leader producing software, hardware, and cloud services including Windows, Office 365, Azure cloud platform, Xbox gaming, and Surface devices. Industry: Software & Cloud Computing

Microsoft currently has 598 open roles on FindRole.

Listed pay typically runs $119,800–$234,700 across 586 roles with salary data.

Most-posted roles

View all roles at Microsoft

At a glance

TL;DR · Senior Security Researcher and Principal Security Researcher

Role Posting Log in to save

Senior Security Researcher and Principal Security Researcher roles are available on the AI Evaluation Systems team to build the evaluation backbone for agentic engineering in Microsoft Security. You will develop common evaluation platforms, methodologies, and infrastructure to determine if AI agents, models, prompts, tools, memory strategies, or orchestration patterns are ready for production security workflows. Responsibilities include designing end-to-end evaluation harnesses, creating benchmark suites with golden datasets, implementing deterministic validators, automated graders, and trace analyzers. You will measure success metrics like safety, latency, and cost while comparing various configurations to provide evidence-based release decisions. Key skills include experience with LLMs, AI agents, prompt/tool orchestration, and security engineering. The role solves the critical problem of establishing a trust system for autonomous systems in triage, remediation, and scan-to-verified-closure workflows within complex security environments.

Skills

LLMs AI Agents Model Evaluation CI/CD Data Pipelines SAST SCA SARIF Telemetry System Design Automation Frameworks Security Engineering Vulnerability Management

What you'll do

Design and build end-to-end evaluation harnesses for agentic security and engineering workflows.
Create representative benchmark suites and golden datasets including edge cases and adversarial scenarios.
Implement deterministic validators, automated graders, and trace analyzers to make evaluations actionable.
Measure performance metrics including safety, cost, latency, and human-review effort across different models and prompts.
Integrate evaluation results into CI/CD pipelines and release gates to provide evidence for production decisions.
Connect offline evaluation data with real-world production feedback to identify regressions and drift.
Develop reusable playbooks, dashboards, and reference implementations to scale evaluation capabilities across the organization.

What we're looking for

A Doctorate in Statistics, Mathematics, Computer Science, or Computer Security is required.
A Master's degree in a related field with 3+ years of experience in software development, cybersecurity, or threat analysis is required.
A Bachelor's degree in a related field with 4+ years of experience in software development, cybersecurity, or threat analysis is required.
Equivalent professional experience to the specified educational requirements is accepted.
Proven experience building production systems, developer platforms, test infrastructure, and automation frameworks.
Ability to design and implement end-to-end evaluation systems including task definition, dataset creation, and scoring.
Experience with LLMs, AI agents, model evaluation, prompt/tool orchestration, and benchmark design.
Experience in security engineering, vulnerability management, SAST/SCA, or secure development lifecycles.

Save