Overview
We are looking for a Prinicpal Software Engineer for the** Policy & Configuration **team owns the deployment control plane for Microsoft Threat Protection. It controls how every security service deploys across regions and sovereign clouds. The team is replacing a legacy configuration system with .NET Aspire and encoding deployment rules, data-residency constraints, and compliance policies into the toolchain as Roslyn analyzers, CI gates, and typed annotations. The compiler catches what used to break at deploy time. Half the work is architecture. half is cross-org advocacy with partner platform teams. Everything the tool does gets pushed upstream into Azure and .NET. Small team. High leverage.
Responsibilities
This role is for an Principal Software Engineer who wants to define how deployment configuration works across a platform, not just build what's asked.
Responsibilities include:
- Design the migration path from a legacy deployment SDK to .NET Aspire. Define the publishing hooks, plan the incremental cutover, and solve the coexistence problems that come from running old and new systems side by side in production.
- Drive adoption across organizational boundaries. Work directly with Azure platform and .NET partner teams to push deployment capabilities upstream. The goal is getting the right primitives into the infrastructure so the team stops maintaining what should be a platform feature.
- Encode compliance and deployment standards into the toolchain. Data-residency rules, security policies, and configuration constraints that replace tribal knowledge with .NET analyzers, CI gates, and typed annotations. What was once a wiki becomes a compiler check.
- Own architecture decisions for the deployment configuration domain. Evaluate build-vs-contribute upstream tradeoffs, lead design reviews, and set the technical direction.
- Shape the developer experience so service teams deploy through standard .NET code. No specialized SDKs. No deployment-specific tooling to learn. The ordinary path is the correct path.
- Build machine-readable interfaces - MCP servers, structured APIs - so AI agents and human engineers work against the same deployment control plane
Qualifications
Required/Minimum Qualifications:
- Bachelor's Degree in Computer Science or related technical field AND 6+ years technical engineering experience with coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, or Python OR equivalent experience.
Software Engineering IC5 - The typical base pay range for this role across the U.S. is USD $139,900 - $274,800 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $188,000 - $304,200 per year.
Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here: https://careers.microsoft.com/us/en/us-corporate-pay
This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.
Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about **requesting accommodations.**