← All roles

Senior Penetration Testing Engineer

Microsoft· Penetration Testing
Apply on company site
Redmond, WA, Mountain View, CA, New York, NY, Atlanta, GA, Reston, VA, Boston, MA, Washington, DC, Fort Lauderdale, FL, Dallas, TX$119.8k - $234.7kfull-timePosted 4d ago

About the role

Senior-level penetration testing engineer focusing on traditional systems and AI/ML-enabled platforms, including LLM-powered and MCP-based applications, within regulated industries. Responsible for planning, executing, and guiding security assessments across applications, cloud, identity, and networks; leveraging AI-assisted tooling and coordinating with multiple teams to remediate findings.

Responsibilities

  • Plan, research and run manual penetration tests that simulate real-world attackers against Microsoft services, cloud infrastructure, identity, APIs and applications in regulated industries.
  • Test LLM-powered and agent-based applications for prompt injection (direct and indirect), jailbreaks, system-prompt and sensitive-data leakage, insecure output handling, misuse of tool and function calls, excessive agent permissions, and abuse of agent memory and context.
  • Assess the security of agents and MCP servers: tool permissions, authentication and authorization between agents and tools, trust boundaries between agents, and how far an attacker can get when an agent is compromised.
  • Assess the AI supply chain and data pipelines, including retrieval (RAG) data sources, vector stores, model and plugin provenance, and the risk of poisoned training or fine-tuning data.
  • Chain findings across application, cloud, identity, and network layers into realistic attack paths that show business and customer impact.
  • Clarify priorities and dependencies across groups, explain key security issues to upper management, and work with partners to put fixes in place.
  • Use AI agents to speed up recon, triage and regression testing, with clear guardrails and human sign-off.
  • Keep up with new attack research and turn it into team guidance, training and awareness across the Microsoft Security community.

Qualifications

  • Master's Degree in Statistics, Mathematics, Computer Science, or related field AND 3+ years experience in security or related field OR Bachelor's Degree in Statistics, Mathematics, Computer Science, or related field AND 4+ years experience in security or related field • OR equivalent experience.

Skills

Required:Penetration testing
Nice to have:AI/ML security assessmentProgramming

Benefits

  • This section is not explicitly enumerated in the provided text. See official benefits link for details.
Last updated Oct 23, 2026. Interested? Apply on the company site.

About Microsoft

Cloud ComputingConsumer ElectronicsSoftwareTechnologyliquid-ai-recruiting-target
Company profileWebsite

More open roles at Microsoft