Overview

We are looking for a principal people and engineering leader to build and lead security engineering for Microsoft AI.

Microsoft AI develops and trains first-party models that Microsoft publishes and uses across products including Foundry, Copilot, Microsoft 365, and MDASH. The work spans model development and serving, large-scale compute, shared infrastructure, engineering systems, identity, data, and productivity services - the whole operational system that makes large-scale training, experimentation, and deployment possible. In the last year, MAI evolved from a research lab to a full production model factory. You have built or substantially reshaped engineering-heavy security teams before and are prepared to do so again. Your job is to turn Microsoft AI security strategy into a team: hire and develop the engineers responsible for building controls, making security status legible enough to drive organization-wide prioritization decisions, and to build the enabling tools and systems that make the business run faster and more securely. You support this by running the roadmap, establishing the operating mechanisms, being the Directly Responsible Individual for some of security’s key metrics and deliverables, and remaining close enough to architecture, code, telemetry, and incidents to unblock execution directly.

Working with the Deputy CISO, Microsoft AI, you will set priorities, clarify ownership, manage performance, and establish the operating mechanisms needed for a new organization to deliver reliably. You will also join design reviews, pitch in on difficult problems, contribute code or prototypes when useful, participate in incidents, and help establish technical direction. You should know when to execute directly, when to coach, when to delegate, and when the team needs a deeper specialist.

Microsoft security teams earn trust by understanding the mission, staying close to the work, and remaining accountable for outcomes. We prefer useful progress and learning through implementation over perfect plans. We create clarity through explicit priorities, ownership, decisions, and measures. We communicate facts, analysis, uncertainty, and tradeoffs honestly.

What You Will Do

Build and Lead a Security Engineering Team

Hire, onboard, coach, and retain a high-performing team of security engineers, architects, and operators with complementary depth across product and application security, cloud and platform security, identity, detection and response, security tooling, and other priorities as the organization evolves.
Set clear objectives, provide actionable feedback, manage performance transparently, support career growth, and create meaningful opportunities for senior engineers to lead.
Design the team's structure, roles, interfaces, and hiring sequence with the Deputy CISO. Identify where Microsoft AI needs dedicated ownership, where central Microsoft teams create leverage, and where a principal specialist is required.
Create an engineering culture that values technical depth, operational ownership, clear writing, constructive disagreement, and durable systems over repeated one-off fixes.
Raise the team's capability through technical review, mentorship, incident learning, reusable patterns, documentation, and deliberate investment in engineering quality.

Turn Strategy into an Executable Engineering Portfolio

Translate security strategy, threat intelligence, incidents, architectural risk, partner commitments, and business priorities into a focused engineering roadmap with explicit outcomes, owners, milestones, dependencies, and measures.
Run planning and execution mechanisms that make priorities, capacity, commitments, risks, and blocked decisions visible without turning engineers into status reporters.
Work with program management to maintain a clear view of what the team owns, what partner teams own, and where a critical dependency lacks funded ownership. Escalate with evidence, options, and a specific decision request.
Balance urgent risk reduction with investment in secure defaults, reference architectures, automated controls, detection, exposure analysis, identity systems, response tooling, and validation platforms.