The posting
Overview
Microsoft’s mission is to empower every person and every organization on the planet to achieve more. As employees we come together with a growth mindset, innovate to empower others, and collaborate to realize our shared goals. Each day we build on our values of respect, integrity, and accountability to create a culture of inclusion where everyone can thrive at work and beyond.
Microsoft Security is seeking a Senior Security Program Manager to establish and operate the program backbone for a new red team spanning adversarial machine learning, agent security, offensive security, automation and privacy. You will manage how work enters the team, how findings are triaged and tracked, how release-focused engagements are planned, and how evidence is packaged for engineering teams, leadership and independent reviewers. This role sits at the center of the team’s operating model. You will partner with security researchers, applied scientists, engineers, product teams and governance stakeholders to turn complex adversarial work into clear priorities, accountable remediation and predictable review outcomes. Success requires strong security judgment, disciplined program execution and the ability to communicate material technical risk without losing accuracy or urgency.
Responsibilities
- Design and operate the intake, prioritization and engagement-planning process for embedded assignments, release-focused pre-gate reviews and ad hoc requests.
- Maintain the findings lifecycle from initial report through severity assessment, ownership, remediation target, adversarial validation, closure and conversion into durable regression coverage.
- Coordinate red-team engagements across model, evaluation, engineering and product milestones, identifying dependencies and schedule risks early.
- Build clear pre-gate packages containing threat models, attack coverage, findings, fixes, residual risk and supporting evidence for independent review.
- Establish program metrics and operating reviews covering engagement coverage, escape rate, time to verified fix, finding durability and review efficiency.
- Facilitate severity and residual-risk discussions, document decisions and escalate unresolved issues through the agreed MART, AIRT, RAI and DSB processes.
- Partner with researchers and engineers to ensure findings are reproducible, actionable and assigned to accountable owners with realistic delivery dates.
- Manage relationships and operating agreements with AIRT, the MAI Red Team, product security teams, the AI Offense squad and other partner organizations.
- Develop concise executive reporting that communicates attack coverage, material risk, remediation status and decisions needed without obscuring technical evidence.
- Continuously improve the team’s workflows, tooling requirements, engagement templates and governance interfaces as MART scales.
Qualifications
- Bachelor's Degree AND 4+ years experience in engineering, product/technical program management, data analysis, or product development OR equivalent experience.
Other Requirements:
- Experience managing complex technical or security programs across research, engineering, product and governance stakeholders.
- Demonstrated ability to establish operating processes, manage dependencies and drive high-priority findings or risks to accountable resolution.
- Ability to communicate technical risk, severity, trade-offs and residual uncertainty clearly to both technical teams and senior decision-makers.
- Experience with AI security, adversarial machine learning, red-team operations, product security, incident response or vulnerability-management programs.
- Knowledge of agentic systems, large language models, security evaluation, offensive-security workflows or AI governance and launch-review processes.
- Experience defining severity frameworks, managing confidential findings and coordinating remediation across multiple product or engineering organizations.
- Experience building metrics, dashboards, executive reviews and evidence packages for security, compliance or risk decisions.
- Demonstrated ability to build a new technical program, create trusted cross-organizational partnerships and operate effectively in ambiguous environments.
Technical Program Management IC4 - The typical base pay range for this role across the U.S. is USD $119,800 - $234,700 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $160,200 - $261,000 per year.
Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here: https://careers.microsoft.com/us/en/us-corporate-pay
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.
Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.
