Top Cybersecurity Jobs in San Francisco, CA

Design, implement, and maintain high-scale, multi-tenant secure services. Collaborate with cross-functional teams, build automation and resilient components, support live services (including Azure air-gapped regions), participate in on-call rotations, and ensure service reliability and security.

Designs and delivers proactive and reactive cloud security and identity support for mission-critical enterprise customers. The role implements Microsoft identity solutions across on-premises and cloud environments, troubleshoots incidents, assesses performance, provides customer guidance, and coordinates with support, engineering, and account teams. Responsibilities include identity governance, security monitoring, Azure compliance, solution delivery, customer engagement, continuous improvement, and participation in on-call rotations.

Leads customer-facing cybersecurity resilience engagements, including readiness assessments, tabletop exercises, cyber range simulations, threat modeling, playbook development, and incident response planning. Advises technical teams and executives on risks, recovery dependencies, and remediation priorities. Coordinates incident response, threat hunting, infrastructure, engineering, and operations teams; documents engagements, facilitates workshops, improves resilience offerings, and mentors colleagues. Requires cybersecurity experience, cloud security knowledge, resilience frameworks, executive communication, and flexibility for nonstandard hours.

Leads applied research on adversarial AI agents and coordinated swarm behavior. Builds instrumented security environments, analyzes behavioral signatures and provenance, and develops methods to detect, attribute, interrupt, and contain offensive agent swarms. Stress-tests defenses across models, tools, and operating conditions, identifies evasion paths, and produces reproducible evaluation assets and security guidance for red-team and defense partners.

Leads technical security sales engagements through demonstrations, proofs of concept, hackathons, architecture workshops, and customer consultations. Designs secure, scalable cloud and hybrid architectures, resolves technical blockers, improves customer security posture, and accelerates adoption of Microsoft security, developer, cloud, and AI technologies. Builds trusted relationships with technical decision-makers, develops security strategies and competitive plans, and contributes thought leadership in developer and customer communities.

Perform offensive security research and vulnerability discovery for Windows. Build tools/agents and fuzzers, perform code and security design reviews, develop proofs-of-concept mitigations, collaborate with product teams, and engage external researchers to improve OS security.

Leads complex cybersecurity investigations and technical incident response across enterprise on-premises and cloud environments. Sets investigation objectives, analyzes evidence, reconstructs incident timelines, assesses adversary activity and compromise scope, and directs containment and recovery recommendations. Serves as the primary technical contact for customers and executives, coordinates threat hunters and other specialists, manages investigative documentation and handoffs, mentors colleagues, and supports research and knowledge sharing. The role requires a Friday–Monday weekend shift schedule and occasional public holiday work.

Leads cybersecurity infrastructure response, identity containment and recovery for compromised enterprise on-premises, cloud and hybrid environments. Assesses evidence, privilege pathways, trust relationships and security gaps; guides containment, recovery and hardening decisions; communicates findings and risks to customers, executives and response teams. The role also supports incident investigations, proactive compromise assessments, documentation, mentoring and resilience improvements while working a Friday-through-Monday weekend shift.

Leads hypothesis-driven threat hunts across customer environments, correlating endpoint, cloud, identity, network, and third-party telemetry. Identifies adversary activity, determines compromise scope, documents evidence and uncertainty, and recommends response actions. Develops queries, automation, detections, mitigations, and threat intelligence. Supports high-impact incident response, customer and executive briefings, post-incident analysis, research, mentoring, and security improvements while working a Friday-through-Monday weekend shift.

Conduct end-to-end red teaming of generative AI models, agents, applications, and systems to identify cyber and national security vulnerabilities. Develop scalable testing methodologies, exploit weaknesses, lead operational testing sprints, coordinate with product stakeholders, communicate findings, and collaborate with offensive security engineers, adversarial ML researchers, developers, and responsible AI teams to mitigate risks.