← All roles

Principal Security Operations Engineer

Microsoft· Security Operations Engineering
Apply on company site
Redmond, WA$142.8k - $274.8kFull-timePosted 4w ago

About the role

Principal Security Operations Engineer within the QSIT team protecting Microsoft Quantum, owning incident response from detection to closure, and shaping AI-enabled security operations capabilities.

Responsibilities

  • Own cybersecurity incidents affecting Microsoft Quantum, establishing severity and response strategy, directing technical investigation and containment, coordinating recovery, and driving incidents to clear, accountable closure.
  • Manage insider and external threat incident analysis and triage from initial indicators through scoping, forensic review, evidence preservation, case disposition, and root-cause analysis, producing defensible investigative narratives for executive, legal, and compliance review.
  • Drive changes to systems and processes based on incident and risk learnings that cross and impact other teams.
  • Lead cross-functional incident response with Quantum engineering, Microsoft CISO organization, National Security Team, HR, Legal, and Global Trade; provide concise executive updates, document decisions and evidence, and ensure post-incident actions are assigned and completed.
  • Define and drive the requirements, architecture, operating model, and prioritized engineering backlog for an AI-enabled QSIT SOC, covering signal enrichment, triage, investigation, response recommendations, analyst-in-the-loop controls, auditability, and sensitive-data handling.
  • Translate AI SOC needs into measurable capabilities and acceptance criteria, evaluate first- and third-party solutions, guide implementation, and assess operational effectiveness, risk, and readiness for production use.
  • Design, implement, and tune insider threat and cybersecurity detections in Microsoft Sentinel and related platforms; onboard and normalize new security data streams; identify visibility gaps; and convert incident findings into improved detections, controls, runbooks, and monitoring coverage.

Qualifications

  • Doctorate in Statistics, Mathematics, Computer Science, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat modeling, cyber security, anomaly detection, SOC detection, threat analytics, SIEM, IT, or incident response OR Master's Degree in Statistics, Mathematics, Computer Science, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat modeling, cyber security, anomaly detection, SOC detection, threat analytics, SIEM, IT, or incident response OR Bachelor's Degree in Statistics, Mathematics, Computer Science, or related field AND 6+ years experience in software development lifecycle, large-scale computing, threat modeling, cyber security, anomaly detection, SOC detection, threat analytics, SIEM, IT, or incident response OR equivalent experience.

Skills

Required:Incident response leadershipMicrosoft Sentinel / SIEM
Nice to have:AI/LLM in security operationsSecurity governance & cross-functional collaboration

Benefits

  • Not specified in the description.
Last updated Sep 24, 2026. Interested? Apply on the company site.

About Microsoft

Cloud ComputingConsumer ElectronicsSoftwareTechnologyliquid-ai-recruiting-target
Company profileWebsite

More open roles at Microsoft