Principal Silicon Security Architect

Microsoft Silicon, Cloud Hardware, and Infrastructure Engineering (SCHIE) is the team behind Microsoft’s expanding Cloud Infrastructure and responsible for powering Microsoft’s “Intelligent Cloud” mission. SCHIE delivers the core infrastructure and foundational technologies for Microsoft's over 200 online businesses including Bing, MSN, Office 365, Xbox Live, Teams, OneDrive, and the Microsoft Azure platform globally with our server and data center infrastructure, security and compliance, operations, globalization, and manageability solutions. Our focus is on smart growth, high efficiency, and delivering a trusted experience to customers and partners worldwide and we are looking for engineers to help achieve that mission.

The Compute Silicon & Manufacturing Engineering (CSME) organization within SCHIE is responsible for design, development, manufacturing and packaging of Microsoft's state-of-the-art computer chips, notably the Azure Cobalt. Our solutions provide sustainable strategic advantages to Microsoft and enable our customers to achieve more.

As Microsoft's cloud business continues to grow the ability to deploy new offerings and hardware infrastructure on time, in high volume with high quality and lowest cost is of paramount importance. To achieve this goal, the Shared and Custom IP & Silicon (SCIPS) team is instrumental in defining and elivering operational measures of success for hardware manufacturing, improving the planning process, quality, delivery, scale and sustainability related to Microsoft cloud hardware. We are looking for engineers with a dedicated passion for customer focused solutions, insight and industry knowledge to envision and implement future technical solutions that will manage and optimize the Cloud infrastructure.

We are looking for a Principal Silicon Security Architect to lead security architecture for Microsoft custom silicon and SoC platforms. You will translate product threats, customer requirements, and platform security goals into actionable hardware, firmware, and software security architectures. The role spans threat modeling, hardware roots of trust, secure boot and lifecycle management, attestation, confidential computing, isolation, secure debug, cryptographic services, provisioning, physical attack resistance, and security validation. You will partner across system, silicon, IP, firmware, software, verification, validation, and external engineering teams from early concept through production and post-silicon security closure.  

#SCHIE #CSME  #SCIPS

The candidate for this position will be expected and able to complete the following responsibilities:

• Lead end-to-end security architecture for complex SoCs and silicon subsystems from product requirements and threat analysis through architecture signoff, implementation, validation, production, and post-silicon issue resolution.  

• Define the SoC security framework, trust boundaries, security objectives, assets, attacker models, and hardware, firmware, and software responsibilities.  

• Lead threat modeling and security risk assessments covering hardware, firmware, software, microarchitectural, supply-chain, lifecycle, and physical attack surfaces; drive mitigations and residual-risk closure.  

• Architect hardware roots of trust, secure and measured boot, device identity and attestation, key management, secure provisioning, ownership transfer, lifecycle states, secure recovery, and firmware update mechanisms.  

• Define isolation and confidential-computing architecture, including security enclaves or trusted execution environments, memory and I/O protection, access control, privilege boundaries, virtualization, and multi-tenant security.  

• Define secure debug, telemetry, error handling, anti-rollback, tamper response, and manufacturing and field-service security requirements while preserving product diagnosability and supportability.  

• Define cryptographic services and acceleration requirements; evaluate algorithms, protocols, key hierarchies, entropy sources, and implementation tradeoffs for performance, power, area, assurance, and agility.  

• Assess side-channel, fault-injection, replay, rollback, and other physical or microarchitectural threats; partner with design and validation teams on mitigations and security test strategies.  

• Author clear, testable security requirements and architecture specifications, maintain requirements traceability, and establish review, verification, validation, and signoff criteria.  

• Evaluate internal and third-party security IP and vendor solutions; lead architecture reviews and provide data-driven recommendations spanning security assurance, functionality, PPA, cost, schedule, reuse, and risk.  

• Drive cross-functional and cross-company technical alignment, resolve ambiguous or conflicting security requirements, and influence product and platform direction at Principal scope.  

Required Qualifications:

• Doctorate in Electrical Engineering, Computer Engineering, Computer Science, or related field AND 3+ years technical engineering experience OR Master's Degree in Electrical Engineering, Computer Engineering, Computer Science, or related field AND 6+ years technical engineering experience OR Bachelor's Degree in Electrical Engineering, Computer Engineering, Computer Science, or related field AND 8+ years technical engineering experience OR equivalent experience

Other Requirements

• Ability to meet Microsoft, customer and/or government security screening requirements are required for this role. These requirements include but are not limited to the following specialized security screenings: Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud Background Check upon hire/transfer and every two years thereafter.
• This role will require access to information that is controlled for export under export control regulations, potentially under the U.S. International Traffic in Arms Regulations or Export Administration Regulations, the EU Dual Use Regulation, and/or other export control regulations.  As a condition of employment, the successful candidate will be required to provide either proof of their country of citizenship or proof of their US. residency or other protected status (e.g., under 8 U.S.C. 1324b(a)(3)) for assessment of eligibility to access the export-controlled information. To meet this legal requirement, and as a condition of employment, the successful candidate’s citizenship will be verified with a valid passport. Lawful permanent residents, refugees, and asylees may verify status using other documents, where applicable.

Preferred Qualifications:

• 15+ years technical engineering experience 

• OR Bachelor's degree in Electrical Engineering, Computer Engineering, Computer Science, or related field AND 12+ years technical engineering experience 

• OR Master's degree in Electrical Engineering, Computer Engineering, Computer Science, or related field AND 8+ years technical engineering experience 

• OR Doctorate degree in Electrical Engineering, Computer Engineering, Computer Science, or related field AND 5+ years technical engineering experience. 

• Experience architecting security for data-center, cloud, client, gaming, AI accelerator, infrastructure accelerator, or server-class SoCs.  

• Knowledge of hardware roots of trust, security enclaves, trusted execution environments, confidential computing, secure and measured boot, attestation, secure recovery, and secure firmware update.  

• Knowledge of cryptographic algorithms, protocols, key hierarchies, entropy generation, crypto agility, and hardware security modules or TPM-class technologies.  

• Experience with device identity, secure provisioning, manufacturing security, ownership transfer, lifecycle management, anti-rollback, access control, and secure debug.  

• Experience analyzing and mitigating side-channel attacks, fault injection, physical attacks, microarchitectural threats, or supply-chain threats.  

• Experience with memory and I/O protection, IOMMU/SMMU, virtualization, privilege separation, multi-tenant isolation, or secure DMA architectures.  

• Experience defining security verification and validation strategies, including negative testing, penetration testing, emulation, formal methods, fuzzing, or post-silicon security validation.  

• Experience with applicable security standards or certification programs such as FIPS 140-3, CNSA, TCG, DICE, SPDM, or Common Criteria.  

• Experience evaluating third-party security IP and working with external silicon vendors or semiconductor partners through architecture, design, verification, and productization.  

• Experience architecting networking or high-speed I/O subsystems, including hands-on experience with network data paths and/or packet-processing architectures. 

• Experience with PCI Express (PCIe) architecture, integration, or design, including link capabilities, topology, error handling, power/reset flows, hardware/firmware/software interactions and trusted computing via PCIe TDISP/IDE. 

• Experience applying AI-assisted tools to architecture research, specification development, requirements analysis, or engineering productivity. 

Silicon Engineering IC5 - The typical base pay range for this role across the U.S. is USD $142,800 - $274,800 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $188,000 - $304,200 per year.

Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here:
https://careers.microsoft.com/us/en/us-corporate-pay

This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.

Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.