Overview
Microsoft’s Marketing Security Risk & Compliance team is looking for a Senior Security Assurance Engineer to lead complex security reviews and threat modeling for Microsoft Marketing services, platforms, and data. Microsoft Marketing operates a diverse technology estate that includes cloud services, data platforms, business applications, artificial intelligence solutions, and complex integrations across Microsoft. The team partners with engineering and business organizations to identify and address security risk through security reviews, threat modeling, Secure Development Lifecycle practices, data-driven analysis, and continuous remediation. In this role, you will provide senior technical security assurance across a portfolio of Marketing services. You will lead security reviews for complex services and high-impact initiatives, evaluate technical architectures and security evidence, identify material security risks, and partner with engineering teams to drive findings through remediation and closure. You will help modernize security assurance from primarily manual, point-in-time reviews toward a scalable, intelligence-driven model that combines current service data, cloud telemetry, automated evidence collection, AI-assisted analysis, and expert engineering judgment. You will also identify recurring risks and opportunities to improve review standards, automation, and secure engineering practices across Marketing. This role requires strong technical judgment, the ability to operate independently in complex environments, and the ability to translate security findings into actionable engineering work.
Responsibilities
- Lead end-to-end security reviews and threat-modeling engagements for complex Microsoft Marketing services, applications, platforms, and data environments. - Analyze architecture, data flows, trust boundaries, identities, endpoints, privileged access, network exposure, dependencies, logging, cloud configurations, and security controls. - Apply Microsoft security requirements and Secure Development Lifecycle practices to identify design weaknesses, implementation risks, control gaps, and missing evidence. - Lead security assurance for high-impact initiatives, including tenant migrations, new platforms, AI solutions, sensitive-data environments, and major architectural changes. - Evaluate security evidence and make risk-based recommendations on technical issues, remediation, and security requirements. - Facilitate technical security discussions with service owners, developers, architects, security and privacy teams, Responsible AI practitioners, and technical partners. - Validate automated and AI-assisted findings, distinguish material risk from false positives, and focus engineering teams on risks requiring action. - Document validated findings with clear severity, impact, remediation requirements, ownership, and closure evidence. - Translate security findings into clearly owned engineering work and track remediation throu
