Principal Penetration Tester

Hybrid role in Redmond, WA with the scope to lead hands-on penetration testing across applications, cloud, networks, hardware, and critical infrastructure OT systems. This Principal Penetration Tester position at Microsoft (CO+I / TCE) combines technical depth, executive-ready communication, and AI-driven automation to scale reconnaissance, discovery, and testing.

What you’ll do

• Lead and participate in comprehensive penetration testing across application, cloud, network, hardware, and critical infrastructure operational technology (OT) environments, identifying security vulnerabilities and executing end-to-end adversary emulation within approved rules of engagement.
• Operate effectively in uncertain, challenging, and novel environments by identifying unknown risk areas and applying offensive and defensive security operations as appropriate.
• Develop relationships that enable streamlined communication and collaboration, advocating for security change across the organization.
• Provide strategic guidance on priorities, tactics, evaluation strategies, and methodology development, chaining findings into attack paths that demonstrate operational and business impact.
• Organize and direct team work around engagement rules, scoping, executive risk communications, and technical guidance for operations, ensuring remediation of findings is completed according to the defined SLA with on-time reporting and communications.
• Create high-quality executive-level verbal and written presentations, explaining technical details to non-technical audiences and delivering data-driven reporting on operations, including risks, vulnerabilities, system information, and remediation plans.
• Act as a technical operator across different penetration testing offerings, identifying and exploiting misconfigurations while improving detection capabilities and threat visibility.
• Research emerging threats, vulnerabilities, and tools to stay current on the latest attack techniques and security trends.
• Mentor team members and partners, fostering curiosity, collaboration, and technical excellence, and partner closely with detection, threat intelligence, and incident response teams to turn findings into actionable detections.
• Apply AI and automation to scale reconnaissance, discovery, and testing.

Qualifications

• Master’s degree in Statistics, Mathematics, Computer Science, or a related field AND 4+ years of experience in security or a related field
• OR Bachelor’s degree in Statistics, Mathematics, Computer Science, or a related field AND 6+ years of experience in security or a related field
• OR equivalent experience
• Ability to meet Microsoft, customer and/or government security screening requirements, including specialized security screenings such as the Microsoft Cloud Background Check and citizenship verification with a valid passport

Tools and technologies

Experience relevant to C#, Python, C++, Go, PowerShell, .NET, Rust, and penetration testing frameworks and standards including OWASP, MITRE ATT&CK, NIST, with offensive security tools such as OffSec OSCP and OSEP/OSCE3. Familiarity with GPEN, GXPN, GICSP, GRID, and security analytics using KQL, Power BI, and Azure DevOps is beneficial, along with cloud platforms Azure, AWS, GCP. Role also involves AI tooling including Large Language Models (LLMs) and RAG concepts (chunking and embeddings).

Preferred qualifications

• 6+ years experience identifying security vulnerabilities, software development lifecycle, large-scale computing, modeling, cyber security, and anomaly detection
• 6+ years experience coding or scripting in languages such as C#, Python, C++, Go, PowerShell, .NET, Rust or comparable languages
• Familiarity with security standards and frameworks such as OWASP, MITRE ATT&CK, and NIST
• 3+ years experience leading a penetration testing team, including hiring, mentoring, and managing full-time and vendor engineers
• Relevant offensive security certifications including OffSec OSCP, OSEP/OSCE3, GPEN, GXPN, or similar; OT/ICS certifications such as GICSP or GRID
• Experience using open-source and open-weight LLMs, including chunking, embeddings, and RAG techniques
• Expertise developing KQL queries, data models, anomaly detection, correlation analytics, and statistical analysis
• Deep understanding of Azure, with AWS or GCP experience
• Knowledge of OT and Industrial Control Systems (ICS) security
• Organizational and program management skills, plus ability to convey complex concepts to diverse audiences
• Proficiency with Power BI and Azure DevOps for reporting and tracking

Work location

Preference for candidates who can work from the Redmond, WA office three days per week. Qualified candidates who cannot meet this preference are also welcomed.

Pay information

• Typical base pay range across the U.S.: USD $142,800 - $274,800 per year
• Base pay range for the San Francisco Bay area and New York City metropolitan area: USD $188,000 - $304,200 per year
• Certain roles may be eligible for benefits and other compensation. Additional details: https://careers.microsoft.com/us/en/us-corporate-pay

Application timeline

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.