Principal product manager · AI and security

I build the systems I manage.

I'm Joey Cruz. At Microsoft I take AI security agents from preview to enterprise customers, and I built the operating model the company uses to get them ready. Outside work, I founded SOMOS.tech, a volunteer-run nonprofit, and I'm its only engineer: I built the platform, run its security, and operate it with AI agents under rules I wrote.

11 AI security agentstaken through readiness to 800+ enterprise customers
100+ features shippedfrom 270+ customer-driven requests I filed with engineering
18 of 22 previewsI drove reached public preview or general availability
~10,000 engineering dayssaved by a security environment I built for 2,000+ employees

Impact

Sixteen years across security, identity, site reliability, and Marine Corps network operations. This is the work I'd point to, grouped by what it shows.

Setting direction for a new category

Created the readiness operating model for Microsoft's autonomous security agents across the Microsoft Security stack: standardized agent intake, one source of truth for product posture, live FAQs, preview guidance, and readiness reporting. Microsoft Security leadership recognized it as a repeatable system.
Drove the customer-feedback approval gate that unlocked enterprise rollout of a Security Copilot alert triage agent to thousands of customers, turning product, engineering, and customer-experience signals into one go decision.

Shipping with customers

Drove 22 private previews in Azure Active Directory, 18 of which reached public preview or GA, partnering directly with about 20 design-partner customers. The shipped features were adopted by thousands of customers.
Built a private-preview feedback platform for AI-for-SOC features with automated intake, routing, and status updates. 38 customers onboarded, and their feedback became 30+ engineering feature requests through a reusable, governed template.
Onboarded 6 enterprise design partners onto six security agents spanning offense, defense, and posture management, and root-caused 12+ critical bugs with engineering on the way.
Ran the Phishing Triage Agent design-partner program through a leadership transition, landed one of the first customers to flight it, and nearly doubled a strategic customer's Security Copilot consumption.

Leading without authority

Built Microsoft's first fully multi-cloud security environment across Azure, AWS, GCP, third-party SaaS, and third-party identity providers, with end-to-end attack simulation. Setup went from five days to zero for 2,000+ employees, and its resources reached 200,000+ Microsoft employees and powered public documentation, demos, and customer proofs of concept. I led a 12+ person virtual team and 6 vendor partners.
Ran a $500K engineering-readiness program with a 20+ person virtual team, building Just-In-Time and Just-Enough-Access automation that closed 400+ security alerts.

Market, standards, and executive influence

Created Microsoft Entra's analyst review program from scratch and ran 19+ evaluations. Results included Microsoft's first-ever Leader placement in the Forrester Zero Trust Platforms Wave, plus Leader placements from Gartner, IDC, and KuppingerCole.
Named contributor to NIST SP 1800-35, Implementing a Zero Trust Architecture, shaping published guidance on hybrid and multi-cloud authentication and access revocation.
Influenced a nine-figure enterprise security renewal by growing identity adoption at two global customers: passwordless sign-in from 31K to 60K monthly users at one, and B2B guest access from 870 to 58K at the other.
Earned the Executive Briefing Speaker Champion Award for CISO and C-level briefings. Built the top-rated Security Copilot in Defender workshop in its series (423 attendees, NPS 79), now official Microsoft training.

Security and operations depth

Owned access security for that multi-cloud environment and kept it compliant with Microsoft's Secure Future Initiative: passwordless FIDO2, automated joiner-mover-leaver provisioning for 6,000+ accounts, and monitoring that detected and shut down 8 unauthorized access incidents.
As an SRE on Skype for Business, found a cross-service dependency flaw that would have broken the service worldwide, and got the release halted the same day. Cut a 3-day deployment across 40+ datacenters to about 4 hours.
At SOMOS.tech, built a 31-signal account risk engine, fail-closed AI moderation, and a registry of 63 security controls where CI fails the build if a control's enforcement code disappears.

Case studies

Written the way I'd write a decision memo: the problem, what I considered, what I chose, and what actually happened, including what didn't work.

Case study · AI agents · Security

Letting AI agents fix production without handing them the keys

How I decided what a coding agent may do alone on a live platform with real member data, and what three weeks of real fixes taught me about where the line belongs.

Agent autonomy · Separation of duties · Prompt injection · Human in the loop

Coming next: the metric that lied, a funnel problem that wasn't about supply, and an outage nobody could see.

How I work

Start from the real workflow: I turn what SOC analysts, red teamers, and admins actually do into product scenarios, and I get design partners using a preview before I trust my own roadmap.
Build mechanisms, not heroics: I build things other teams can reuse without me. Microsoft Security leadership recognized the agent readiness model as a repeatable system, and the preview feedback platform runs on a governed template any feature team can pick up.
Make decisions legible: I write down the options, the tradeoffs, and why, so a decision can be reviewed and reversed by someone who wasn't in the room. The case studies here are written the same way.
Measure honestly: I report what didn't work alongside what did. A metric that flatters the product is a bug.
Treat security as a product requirement: Least privilege, separation of duties, and failing closed are design decisions I make up front, not findings I wait for in review.

About

I started as a cyber network operator and platoon sergeant in the U.S. Marine Corps, including running data networks for a fire-support battery in Afghanistan. At Microsoft I was a site reliability engineer, then a product manager in identity and Zero Trust across Azure Active Directory and Microsoft Entra, then Security Copilot, and now agentic security operations.

SOMOS.tech is where I build. It's a 501(c)(3) for Latino and Hispanic technologists, with free programs in AI, careers, and mentorship run by 20+ volunteers. I wrote its platform, its account risk engine, its content moderation, and the agents that help me operate it. The case studies come from that work, because I can show all of it.

CISSP · GIAC GDSA · U.S. Marine Corps veteran · Spanish and English, native

Contact

Find me on LinkedIn.