AI Security Engineer

Overview

Design, build, and secure realistic, reproducible cyber ranges that enable rigorous offensive evaluations of frontier AI systems while safely containing model and agent activity.

About the Role

The Cloud & AI organization accelerates Microsoft’s mission to secure digital technology platforms, devices, clouds, and AI systems across customers’ heterogeneous environments and Microsoft’s own internal estate. Our culture is centered on a growth mindset, inspiring excellence, and helping teams and leaders bring their full potential every day.

Microsoft Red Team (MRT) emulates real-world advanced persistent threats against Microsoft and an ecosystem of external customers. As frontier AI systems become increasingly capable of reasoning, coding, tool use, exploitation, and autonomous execution, understanding when and how these systems materially increase offensive cyber capabilities is becoming an increasingly important component of Microsoft’s AI security mission.

MRT Strategic AI is seeking an AI Security Engineer focused on Cyber Range Engineering. This is a hands-on systems and security engineering role responsible for designing, building, hardening, and operating realistic cyber ranges where frontier AI models and agents can be safely evaluated against offensive objectives.

This role operates at the intersection of cyber-range engineering, cloud and virtualization infrastructure, offensive security, and agentic AI safety. The role involves translating evaluation requirements into production-like environments with realistic identities, hosts, services, trust relationships, attack paths, telemetry, validation, and reset mechanisms.

A critical aspect of the role is understanding the offensive evaluations that the ranges support and engineering appropriate security boundaries around them. This includes authorization, credentials and secrets, execution isolation, network egress, orchestration, monitoring, interruption, recovery, and forensic evidence.

Cyber-capable models may probe the evaluation harness, exploit unintended paths, seek external connectivity, or act outside the intended task. The role therefore requires a focus on containment, monitoring, and secure-by-design engineering.

This opportunity is suited to candidates with experience in cyber-range and platform security, combined with offensive security knowledge.

Responsibilities

• Design, build, and operate realistic, versioned, infrastructure-as-code cyber ranges spanning cloud, identity, endpoint, network, application, container, and multi-host attack surfaces.
• Model production-like organizations, architectures, products, configurations, trust relationships, user behavior, data, and telemetry so evaluations require authentic multi-step offensive reasoning.
• Translate evaluation objectives into repeatable scenarios with explicit prerequisites, authorized boundaries, expected attack paths, ground-truth validation, scoring signals, and automated reset contracts.
• Engineer reliable lifecycle automation for provisioning, validation, execution, teardown, sanitization, and recovery across concurrent evaluation runs.
• Design defense-in-depth controls for cyber-capable models and agents, including identity and authorization boundaries, least-privilege credentials, secrets isolation, capability-gated tools, workload isolation, and fail-closed enforcement.
• Control and observe all network paths, including default-deny egress, approved destinations, DNS and traffic inspection, rate and scope controls, and automated interruption when activity crosses policy or range boundaries.
• Build independent telemetry across model calls, agent trajectories, tool invocations, process execution, filesystem changes, identity use, network traffic, and control-plane activity; produce attributable, tamper-resistant evidence for investigation and scoring.
• Continuously test the range and evaluation harness for sandbox escape, lateral movement, prompt or tool injection, credential exposure, supply-chain risk, benchmark cheating, persistence, and unintended access to evaluator or production infrastructure.
• Define operational controls for emergency stop, credential revocation, workload quarantine, evidence preservation, incident response, and rapid rebuild; exercise these controls before enabling higher-capability models.
• Partner with evaluation researchers, red-team operators, cloud and platform teams, and security response functions to convert new evaluation needs and observed failure modes into durable range capabilities and controls.
• Document threat models, architecture decisions, control assumptions, operating procedures, residual risk, and evidence of containment for each range and model-access tier.