Principal Software Engineer

Secure the next generation of Copilot experiences

The Copilot Security Engineering team sits at the core of Microsoft’s mission to deliver secure, trusted, and human-centered AI experiences across Microsoft’s Copilot offerings. We build the systems that detect, evaluate, and defend against emerging AI threats, including prompt injection, memory poisoning, data exfiltration, adversarial inputs, and abuse of agentic workflows. Our goal is to establish industry-leading security protections that enable customers to confidently adopt AI at scale.

Our team combines security engineering, AI systems expertise, and threat research to identify emerging risks, develop novel defenses, and continuously measure their effectiveness in production. We work closely with product teams, Microsoft Research, and platform organizations to ensure security is built into every layer of the Copilot ecosystem.

We are looking for a Principal Software Engineer to set technical direction and own the architecture of AI threat detection and defense capabilities spanning multiple Copilot experiences. You will turn ambiguous, evolving threats into an actionable engineering strategy and reusable platform protections, aligning partners on priorities, interfaces, and measurable security outcomes.

This is a hands-on individual contributor role at the intersection of security, AI, and large-scale distributed systems. You will design and write production code, lead complex work from threat discovery through deployment and operation, and remain accountable for the effectiveness and reliability of the defenses you deliver. Your impact will extend through cross-team architectural decisions, partner influence, and mentorship, rather than people management.

This position is based in Redmond, Washington and requires the employee be in the office a minimum of 3 days per week.

Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

• Define and drive a multi-team technical strategy for Copilot security. Translate emerging threats and product needs into prioritized engineering investments, architectural decisions, and an executable roadmap with clear ownership and success measures.
• Own the end-to-end architecture and hands-on implementation of detection and defense systems for prompt injection, indirect prompt attacks, memory poisoning, data exfiltration, model misuse, and abuse of agentic workflows. Resolve ambiguous problems across AI workflows, tools, orchestration layers, trust boundaries, and platform integrations.
• Build reusable security services, classifiers, evaluation frameworks, telemetry pipelines, and risk assessment capabilities. Establish extensible interfaces and integration patterns that enable multiple Copilot teams to adopt durable protections instead of duplicating point solutions.
• Define security effectiveness measures and release criteria with partners, including attack coverage, detection quality, false-positive impact, and mitigation effectiveness. Use adversarial evaluations and production telemetry to validate improvements, detect regressions, and balance protection with latency, reliability, cost, and customer experience.
• Lead threat modeling and architectural security reviews across team boundaries. Partner with security researchers, Microsoft Research, product teams, and platform organizations to investigate emerging attack techniques, validate defenses, and turn research findings into deployable engineering capabilities.
• Remain accountable for production readiness and ongoing operation of security capabilities. Establish observability, safe rollout and rollback approaches, and operational practices; participate in on-call rotations and lead cross-team investigations during complex security events.
• Drive root cause analysis and durable remediation after security incidents. Address systemic failure modes through shared platform defenses, regression coverage, and improvements to detection, response, and recovery.
• Influence architectural choices and engineering investments without direct authority. Build agreement on technical tradeoffs, dependencies, and adoption plans, and communicate risk, progress, and security outcomes clearly to engineers, product partners, and leadership.
• Raise engineering quality through design and code reviews, technical mentorship, and knowledge sharing. Help engineers reason about AI security and distributed systems, grow technical ownership, and apply sound engineering practices while continuing to contribute directly to critical implementations.

• Bachelor's Degree in Computer Science or related technical field AND 6+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python
  • OR equivalent experience.

Other Requirements:

Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include but are not limited to the following specialized security screenings:

• Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud background check upon hire/transfer and every two years thereafter.

Preferred Qualifications: