Senior Security Operations Engineer

Overview The Cloud & AI organization accelerates Microsoft’s mission and bold ambitions to ensure that our company and industry is securing digital technology platforms, devices, and clouds in our customers’ heterogeneous environments, as well as ensuring the security of our own internal estate. Our culture is centered on embracing a growth mindset, a theme of inspiring excellence, and encouraging teams and leaders to bring their best each day. In doing so, we create life-changing innovations that impact billions of lives around the world. Microsoft is one of the largest enterprise service companies in the world.

Security represents one of the most critical priorities for our customers in a world awash in digital threats, regulatory scrutiny, and estate complexity. The Office of the Chief Information Security Officer (CISO) is accountable for managing and prioritizing cybersecurity risks for Microsoft. This team oversees the company’s overall cyber defense, including the security of Microsoft products and business operations, and collaborates with Engineering teams to advance Secure Future Initiative (SFI) objectives.

Security is a core priority for Microsoft, and Identity and Access Management protections are essential to protecting Microsoft at global scale. We are looking for a Senior Security Operations Engineer with deep expertise in tenant management and identity security to drive security operations, incident response, and large-scale remediation across Microsoft’s identity ecosystem. This role combines strong technical expertise with data-driven security operations to identify systemic risks, lead security and incident campaigns, strengthen tenant protections, and partner with engineering teams to deliver scalable and durable security improvements.

Responsibilities

• Serve as a technical subject matter expert for enterprise tenant and identity security, applying deep knowledge of tenant architecture, configuration, identity controls, authentication, authorization, application identities, service principals, privileged access, and identity lifecycle management.
• Identify and drive remediation of systemic security risks across tenant and identity environments, connecting individual findings and incidents to broader patterns and developing scalable approaches to address them.
• Lead complex identity and tenant security campaigns end-to-end, including problem discovery, technical scoping, risk assessment, investigation, prioritization, engineering remediation, validation, and closure.
• Lead technical investigations of identity and tenant security incidents, determining root cause and impact and driving containment, remediation, and preventative actions across affected environments.
• Partner deeply with Software Engineering teams to translate security risks into technical requirements and durable platform improvements, influencing engineering priorities and design decisions where necessary.
• Analyse tenant configuration, identity telemetry, security signals, and operational data to identify emerging risks, recurring issues, anomalous behaviour, and opportunities for proactive protection.
• Design and drive scalable security protections and remediation mechanisms that improve the ability to detect, prevent, and remediate tenant and identity risks across large-scale environments.
• Establish technical strategies for recurring security problems, moving beyond individual remediation to improve platform capabilities, automation, detection, protection, and operational resilience.
• Drive measurable security outcomes across multiple technical workstreams, maintaining ownership of risks, dependencies, exceptions, remediation commitments, and engineering outcomes through closure.
• Influence senior engineering and security stakeholders through technical expertise, data, and clear articulation of risk, trade-offs, and recommended solutions.

Qualifications

• Bachelor’s Degree in Computer Science, Information Technology, Cybersecurity, or related technical field AND 6+ years of experience in identity and access management, security engineering, cybersecurity, security operations, or a related technical field
• OR equivalent experience.

• 5+ years of hands-on experience with enterprise identity and tenant environments, with deep expertise in tenant configuration, identity architecture, authentication, authorization, application identities, service principals, privileged access, or identity lifecycle management.
• 4+ years of experience independently driving complex identity or tenant security investigations and remediation campaigns, including technical assessment, risk prioritization, engineering remediation, validation, and closure.
• Strong experience working with Microsoft identity and cloud technologies, with the ability to understand tenant-level security controls, dependencies, and operational behaviour at enterprise scale.
• Experience partnering directly with Software Engineering and Security teams to investigate complex technical problems and drive scalable security improvements.

Preferred Qualifications

• Deep expertise with Microsoft Entra ID, Active Directory, Azure, and enterprise tenant environments, including tenant architecture, configuration, security controls, and identity dependencies.
• Experience leading large-scale identity or tenant security incidents, remediation campaigns, or security posture initiatives across complex enterprise environments.
• Experience in security detection, incident response, protection, threat investigation, or security operations, particularly in identity-focused environments.
• Experience working on Microsoft Secure Future Initiative (SFI) programs, security campaigns, or enterprise-wide security posture improvements.
• Experience building or driving automation, detection, telemetry, or security tooling to identify and remediate tenant and identity risks at scale.
• Demonstrated ability to act as a technical leader without direct authority, influencing engineering direction, resolving cross-team dependencies, and driving ambiguous security problems to measurable outcomes.

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.