Security Researcher

Job d:

Location:

United States, Washington, Redmond Salary: USD $119,800 - $234,700 per year

Employment type:

Full-Time Work site: 3 days / week in-office

Role type:
Individual Contributor Travel:
Less than 25%
Profession:
Security Engineering Discipline:
Security Research Company:
Microsoft Overview The  MDASH team is advancing how organizations discover and resolve vulnerabilities in source code. MDASH uses a multi-agent, multi-model system to analyze code, validate whether potential vulnerabilities are real and reachable, and provide developers with concrete fixes and guidance for verifying that code is no longer vulnerable. We are seeking a Principal Security Researcher to build and improve the AI-powered, agentic system at the heart of MDASH vulnerability discovery, validation, and resolution.

You will combine deep vulnerability research with AI experimentation: researching vulnerability classes and language ecosystems, identifying representative evaluation targets, building and reviewing ground truth, analyzing missed and incorrect findings, and developing improvements that measurably increase recall, precision, consistency, and fix quality. We are looking for a hands-on vulnerability researcher who can read unfamiliar code, trace attacker-controlled data to security-sensitive operations, develop and use fuzzers and other analysis tools, reproduce vulnerabilities, assess exploitability and reachability, and determine whether a proposed fix addresses the underlying weakness.

You will carry research from hypothesis through implementation and measurement, directly building and evaluating improvements to MDASH's agents, tools, model configurations, and analysis methods while collaborating with engineering and applied science partners. Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals.

Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.

Responsibilities Conduct hands-on vulnerability research across vulnerability classes, languages, frameworks, and codebase architectures to discover and validate vulnerabilities, assess reachability and exploitability, evaluate fixes for security correctness, and identify opportunities to expand MDASH coverage. Translate research and evaluation insights into implemented improvements to MDASH agents, tools, model configurations, and analysis methods, and measure their impact. Identify representative evaluation targets and author trusted ground truth spanning vulnerability evidence, attack paths, severity, validation, and remediation.

Drive MDASH's eval-driven development and hill-climbing loop by running evaluations, uncovering patterns in missed and incorrect results, and creating adversarial and regression cases that turn blind spots into measurable capability gains. Build research prototypes, fuzzing harnesses, datasets, graders, and automation that accelerate capability improvement. Provide technical leadership across the MDASH security research team by shaping research direction, leading complex investigations, mentoring other researchers, and raising the quality of vulnerability research and implementation.

Collaborate across research, engineering, applied science, and product teams to deliver improvements, communicate results, and influence technical direction. Qualifications Bachelor's, Master's, or Doctorate Degree in Computer Science, Computer Security, Computer Engineering, or a related field OR equivalent experience. 8+ years of experience in vulnerability research, application security, offensive security, secure software development, program analysis, or related security work. Demonstrated hands-on experience discovering, reproducing, and validating software vulnerabilities;

assessing reachability and exploitability; and evaluating remediation correctness.

Experience with fuzzing and at least one additional vulnerability research technique, such as manual code review, static analysis, dynamic analysis, debugging, reverse engineering, symbolic execution, taint analysis, or exploit development. Proficiency developing security research tooling or automation in one or more programming languages. Experience communicating complex technical findings through clear written reports, vulnerability analyses, or…