The posting
Overview
Team Purpose
The Microsoft AI Infrastructure Information Security Governance, Risk, Automation, Compliance, and Engineering team helps build and maintain a secure, scalable, and sustainable compliance environment. You will partner across security, engineering, legal, privacy, audit, and other teams to translate risk and compliance requirements into controls that can be implemented, monitored, and continuously improved. Together, the team connects requirements, risks, controls, evidence, and monitoring so compliance can scale with AI infrastructure, technology, and business needs.
Role Summary
As a Senior Risk & Compliance Engineer in the Microsoft AI Infrastructure Information Security team, you will independently own defined security risk and compliance areas from initial onboarding and risk assessment through control design, implementation partnership, assurance, continuous monitoring, and improvement. You will interpret regulatory, policy, customer, and assurance requirements; translate them into practical control objectives; evaluate implementation across complex technical systems; and drive remediation of identified gaps. You will also use data, telemetry, evidence pipelines, and automation to provide ongoing visibility into control health and help make compliance audit-ready by default.
This opportunity will allow you to deepen your technical risk and compliance expertise, advance continuous controls monitoring and compliance automation, and expand your influence across security, engineering, and assurance teams.
Microsoft Culture Statement
Microsoft's mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond
Responsibilities
Responsibilities
- Independently manage defined security compliance areas through the end-to-end lifecycle, evaluate applicable laws, regulations, policies, customer commitments, and assurance requirements, and map them to risks, control objectives, controls, systems, evidence, and accountable owners.
- Develop strategies and processes for compliance programs, use judgment to anticipate new focus areas as the regulatory, product, technology, and threat landscape evolves, and identify and escalate material non-conformance through appropriate governance channels.
- Partner with security and engineering teams to define practical, measurable, and testable controls; identify potential failure points; integrate secure-by-design practices; and establish clear ownership, evidence, monitoring, and remediation requirements.
- Analyze system architecture, data flows, configurations, access models, logs, telemetry, scripts, queries, code, and other technical artifacts to assess control design and implementation and identify compliance or coverage gaps.
- Independently test control effectiveness, conduct readiness assessments, use judgment to identify improvements, and work with stakeholders to remediate gaps, address root causes, track issues through closure, and support incidents when needed.
- Conduct routine and complex internal assessments and audits, prepare teams for external reviews, and support certifications, audits, and regulatory requirements with reliable, reusable, and defensible evidence and documentation.
- Translate control criteria into measurable monitoring requirements and use system-generated data, dashboards, telemetry, logs, configurations, and other signals to monitor control execution, exceptions, and health.
- Develop requirements for internal tools, automated evidence collection, reusable monitoring, and compliance systems of record that reduce manual work, improve quality, and transition programs from point-in-time assessment to continuous controls monitoring.
- Use approved AI-enabled tools to improve compliance research, drafting, evidence review, and reporting while validating outputs through subject-matter review and traceability to authoritative sources.
- Educate teams on compliance requirements, translate standards and processes for technical and non-technical audiences, collaborate across teams to apply requirements consistently, and serve as a liaison among security, engineering, legal, privacy, audit, and business stakeholders.
- Develop and report compliance metrics, key performance indicators, control health, audit issues, remediation progress, and risk trends for internal and external audiences, incorporating relevant customer feedback into program improvements.
- Embody our culture and values
Qualifications
Required Qualifications
- Bachelor's Degree in Legal, Finance, Science, Business, Engineering, or related field AND 6+ years experience in business, legal/regulatory, compliance, audit/consulting firm OR equivalent experience.
Other Qualifications
Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include, but are not limited to the following specialized security screenings:
Microsoft Cloud Background Check:
- This position will be required to pass the Microsoft background and Microsoft Cloud background check upon hire/transfer and every two years thereafter.
Preferred Qualifications
- Juris Doctor (JD) Degree AND 7+ years experience in business, legal/regulatory, compliance, audit/consulting firm OR Master's Degree in Legal, Finance, Science, Business, Engineering, or related field AND 8+ years experience in business, legal/regulatory, compliance, audit/consulting firm OR Bachelor's Degree in Legal, Finance, Science, Business, Engineering, or related field AND 12+ years experience in business, legal/regulatory, compliance, audit/consulting firm OR equivalent experience.
- Relevant Certification (e.g., International Organization for Standardization [ISO] Lead Auditor, Certified Information Systems Auditor, Certified Information Systems Security Professional, Certified Public Accountant [CPA], Certified Information Privacy Professional [CIPP]).
- Experience translating regulatory, policy, security, or assurance requirements into technical controls and assessing control design, implementation, effectiveness, and evidence.
- Experience with security and assurance frameworks such as ISO 27001, Service Organization Control 2 (SOC 2), Payment Card Industry Data Security Standard (PCI DSS), National Institute of Standards and Technology (NIST) frameworks, or comparable regulatory and industry standards.
- Experience using data, telemetry, dashboards, automated workflows, evidence pipelines, governance, risk, and compliance systems, or systems of record to evaluate control health and support audits.
- Technical risk or compliance experience across areas such as identity and access management, application security, cloud and infrastructure security, vulnerability management, data protection, security operations, resilience, software supply-chain security, third-party security, or AI security.
- Ability to identify systemic patterns across control gaps and findings, translate them into scalable technical or process improvements, and communicate risks and remediation needs clearly across technical and non-technical audiences.
#AIINFRA
Compliance IC5 - The typical base pay range for this role across the U.S. is USD $116,900 - $203,600 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $148,400 - $222,600 per year.
Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here: https://careers.microsoft.com/us/en/us-corporate-pay
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.
Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.
