Principal Software Engineer

The Substrate Directory IDC organization owns foundational capabilities across Provisioning, Groups, and Manageability that are critical to Microsoft 365 administration and directory experiences.

We are looking for a Principal Software Engineer who will provide end-to-end security leadership across these areas. The role will work closely with engineering teams to ensure that new features, modernization investments, APIs, administrative operations, and service-to-service interactions are secure by design.

The role will combine deep expertise in identity, authentication and authorization, privileged operations, API security, distributed systems, and threat modeling with the ability to influence architecture across multiple teams.

The broader Substrate Identity and Directory strategy makes customer trust, security initiatives, service hardening, least-privileged access, and reducing privileged dependencies key priorities.

Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

Responsibilities

• Own the security architecture and security design principles across the three IDC areas spanning across authentication, authorization, privilege operations, least privilege access to directory resources, isolation, threat modelling.
• Review major architectural changes, APIs and modernization initiatives for security risks.
• Define reusable security patterns and guardrails that teams can adopt rather than solving security independently in each feature.
• Identify systemic security risks that span multiple components and drive architectural solutions.
• Ensure security is incorporated early in engineering design rather than addressed primarily through post-design reviews.
• Lead threat modelling for major features and architectural changes. Identify trust boundaries, attack surfaces and potential privilege-escalation paths.
• Work across Provisioning, Groups and Manageability rather than belonging to the security implementation of one component. Partner with identity, authentication/authorization and security organizations.
• Help design and build AI agents for SFI workflows such as finding and fixing compliance issues, collecting evidence, inventorying and rotating secrets, enforcing configuration rules, and triaging work items etc.

Qualifications

Required/Minimum Qualifications:

• Bachelor's Degree in Computer Science or related technical field AND 6+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python.
  • OR equivalent experience.

Additional or preferred qualifications

Other Requirements: Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include but are not limited to the following specialized security screenings:

• Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud background check upon hire/transfer and every two years thereafter.

Preferred Qualifications:

• Bachelor’s degree in computer science or related technical field AND 10+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python.
• Solid experience designing and securing large-scale distributed/cloud services.
• Deep understanding of identity, authentication and authorization.
• Solid understanding of least privilege, defense in depth, trust boundaries and secure-by-design principles.
• Experience designing or reviewing service-to-service authentication and authorization.
• Experience with application/service identities, certificates, credentials and secrets.
• Experience conducting threat modeling and architecture security reviews.

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.