Principal Software Engineer

Working across COSMIC, M365, and partner security organizations, you will turn ambiguous security and compliance requirements into durable platform architecture, establish engineering standards, drive multi-team execution, and raise the security capability of the broader organization through technical leadership and mentorship. Own the security architecture, technical strategy, implementation, rollout, and operation of foundational COSMIC security services across globally distributed, high-scale infrastructure. Design and build highly available certificate lifecycle systems, including enrollment, issuance, secure delivery, validation, renewal, revocation, expiry prevention, trust distribution, and root and intermediate CA rotation. Build resilient key and secrets management capabilities, including KMS integration, encryption at rest, key-version transitions, automated reconciliation and validation, hardware-backed protection where appropriate, auditability, and emergency recovery. Advance identity and authorization for multi-tenant Kubernetes and cloud-native infrastructure using workload identity, scoped managed identities, namespace and workload isolation, mutual TLS, least-privilege RBAC, policy enforcement, and secure secret delivery. Own trust and issuer-change readiness across public and sovereign environments, including cryptographic agility, operating-system and container trust behavior, compatibility validation, migration guidance, and uninterrupted fleet availability. Threat model complex distributed systems and investigate cross-tenant or cross-workload privilege boundaries; translate findings into secure-by-default APIs, platform guardrails, enforcement points, migration plans, and safely deployable remediation. Establish security invariants, service-level objectives, inventories, expiry alerts, telemetry, detection, audit, and post-change validation that continuously demonstrate the health and integrity of certificate, key, identity, and secrets systems. Lead production readiness and operations through ring-based deployment, feature gating, compatibility and failure testing, automated rollback, blast-radius containment, incident response, on-call excellence, troubleshooting guidance, and durable follow-up. Drive end-to-end security features across control planes, resource provisioning, agents and controllers, Kubernetes custom resources, cloud authorization, and workload consumption paths, with meaningful integration and regression testing. Lead cross-team architecture and execution across platform, identity, cloud infrastructure, security response, and partner engineering; clarify ownership boundaries, resolve long-range dependencies, contribute production code and design documents, and mentor engineers in security and distributed-systems practices. Bachelor's Degree in Computer Science or related technical field AND 6+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python These requirements include but are not limited to the following specialized security screenings: Master's Degree in Computer Science or related technical field AND 8+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python OR Bachelor's Degree in Computer Science or related technical field AND 12+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python OR equivalent experience. 3+ years of experience designing, building, or operating security-critical software or infrastructure in areas such as PKI, certificates, cryptographic key management, secrets management, identity, authentication, or authorization. Experience designing and operating distributed systems or cloud services with high availability, reliability, observability, and incident-response requirements. Direct experience and knowledge of X.509, certificate authorities, certificate path validation, revocation, TLS/mTLS, cryptographic primitives, trust models, and secure key custody. Experience with managed HSMs, KMS platforms, secret stores, certificate automation, Secrets Store CSI Driver, SPIFFE/SPIRE, service mesh security, or workload identity systems. Experience securing multi-tenant Kubernetes, container platforms, controllers/operators, custom resources, control planes, or infrastructure spanning multiple regions, tenants, and fault domains. Demonstrated ability to lead architecture and deliver multi-team security initiatives from problem definition through production adoption and sustained operations. Experience with zero-trust architecture, least-privilege design, namespace and workload isolation, policy-as-code, admission control, secure bootstrap, or supply-chain security. Experience designing migrations for trust anchors, certificate issuers, protocols, algorithms, identities, or key material across public and sovereign environments while maintaining compatibility and service availability. Solid threat-modeling, security review, debugging, and incident-investigation skills, including the ability to reason about failure modes, abuse paths, and systemic risk. Experience using inventories, reconciliation, telemetry, security signals, audits, exercises, and measurable controls to prevent expiry, detect partial rollout, and improve operational outcomes. Ability to communicate complex security decisions clearly, influence senior stakeholders, build alignment across teams, and mentor engineers in security engineering practices.