This list contains only the countries for which job offers have been published in the selected language (e.g., in the French version, only job offers written in French are displayed, and in the English version, only those in English).
The Microsoft Security Analysis & Fix Engineering (SAFE) team is dedicated to building and leveraging the world's most advanced static analysis platform to rapidly and accurately identify security weaknesses across the billions of lines of source code that go into Microsoft's products and services, empower efficient and effective corrective action by both developers and LLMs, and build complementary analysis capabilities to enable more effectively perform proactive secure development across the entirety of Microsoft. Our ambition is to make it effortless to elevate and keep billions of lines of code at the most cutting edge of security understanding.
Job Responsibility:
Investigate code vulnerabilities and generalize code patterns for detections
Create static code analysis rules and expressions for finding vulnerable code patterns
Apply static code analysis and validate results manually and using automation
Improve tooling used in static code analysis and results processing
Assist with active incident research, detection, mitigation and post-incident response
Embody our culture and values
Requirements:
Master's Degree in Statistics, Mathematics, Computer Science, Risk Management, Cyber Security, or related field AND 4+ years of experience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detection
OR Bachelor's Degree in Statistics, Mathematics, Computer Science, Risk Management, Cyber Security, or related field AND 6+ years of experience in software development lifecycle, large scale computing, threat modeling, cyber security, or anomaly detection
OR equivalent experience
Ability to meet Microsoft, customer and/or government security screening requirements
Required to pass the Microsoft background and Microsoft Cloud background check upon hire/transfer and every two years thereafter
Nice to have:
5+ years of experience with 2 or more programming languages (e.g. C++, C#, Java, JavaScript, TypeScript, VBScript, Go, Ruby, Python, Rust, Swift, Powershell, PHP, SQL, etc.)
1+ years of experience using a query language (SQL, Linq, Splunk, Kusto, etc)
3+ years of experience with one or more areas of security from an AppSec standpoint, e.g. OS/System security, network and cloud security, web or mobile application security, etc
3+ years of experience performing security code reviews
1+ years of experience with Regular Expressions
3+ years of experience working with cloud services and microservice architecture (preferably with Azure)
Familiarity with .NET CLI (IL, bytecode), Java Bytecode, x86 or ARM ASM, or other compilable target
Experience applying AI and LLM, and especially experience understanding how LLMs function