Your work days are brighter here.
We’re obsessed with making hard work pay off, for our people, our customers, and the world around us. As a Fortune 500 company and a leading AI platform for managing people, money, and agents, we’re shaping the future of work so teams can reach their potential and focus on what matters most. The minute you join, you’ll feel it. Not just in the products we build, but in how we show up for each other. Our culture is rooted in integrity, empathy, and shared enthusiasm. We’re in this together, tackling big challenges with bold ideas and genuine care. We look for curious minds and courageous collaborators who bring sun-drenched optimism and drive. Whether you're building smarter solutions, supporting customers, or creating a space where everyone belongs, you’ll do meaningful work with Workmates who’ve got your back. In return, we’ll give you the trust to take risks, the tools to grow, the skills to develop and the support of a company invested in you for the long haul. So, if you want to inspire a brighter work day for everyone, including yourself, you’ve found a match in Workday, and we hope to be a match for you too.
About the Team
Workday's Cybersecurity & Trust organization exists to inspire confidence and trust in Workday. We safeguard the personal information of 60+ million people and the financial information of some of the largest companies in the world. Cybersecurity is woven into the fabric of Workday and is core to everything we do. We nurture a security-first mentality and believe that moving with speed and velocity is enabled by building security into the foundation. Build the future of Cybersecurity at Workday by applying innovative technology to a customer-centric platform! The Workday Enterprise Security team safeguards Workday's vital data, infrastructure, and applications through authority, technical solutions, and risk mitigation across all enterprise systems, concentrating on security architecture, engineering, and infrastructure. We select, engineer, and lead a robust suite of technical controls to actively prevent, detect, and respond to threats. Ultimately, Enterprise Security acts as the central line of defense, proactively leading security posture, ensuring operational resilience, and maintaining customer trust in Workday's dedication to security excellence. Within Enterprise Security, the Enterprise Identity team is where identity meets impact. We own and evolve the Identity and Access Management systems that serve as Workday's first and most critical line of defense governing who gets access, to what, and why. From zero-trust architecture and privileged access governance to identity lifecycle automation and federation at scale, we operate across one of the most complex enterprise environments in cloud software. As a Principal IAM Engineer here, you'll architect bold solutions, challenge assumptions, and drive decisions that protect Workday at its core. If you're energized by hard problems at the intersection of identity, security, and engineering excellence, this is where you belong.
Show the full description
About the Role
Identity is Workday's most important security boundary. It protects the personal data of 60+ million people and the financial data of some of the world's largest companies. Our identity surface spans multi-account AWS, enterprise SaaS, a global workforce, and a fast-growing set of AI agents and workloads.
We're looking for a Principal engineer to own the strategy and architecture of our IAM program. You'll set the patterns other engineers build against and make the calls that determine how we scale. You'll also help define how to secure AI agents in production, a problem the industry is still working out.
This is a strategic, hands-on architecture role, not an operations role. You'll work directly with engineering, security, and Risk leadership, and you'll have real influence over the direction of identity at Workday.
What you'll do
Own the multi-year IAM architecture and roadmap across human and non-human identity, cloud authorization, federation, and secrets management.
Design and evolve AWS identity at scale, including Organizations, SCPs, IAM Identity Center, ABAC, and least-privilege patterns across hundreds of accounts.
Architect workforce identity: SSO, adaptive MFA, SCIM provisioning, and lifecycle automation.
Define identity patterns for AI agents and service-to-service workloads, including how they authenticate, what they can assume, and how their actions are observed and governed.
Drive Zero Trust in practice through identity-aware access, conditional policies, and workload-level controls.
Embed identity guardrails into Terraform and CI/CD so secure is the default path.
Partner with Risk and GRC to turn threat exposure into pragmatic decisions, and push back on controls that add friction without reducing risk.
Mentor engineers and raise the IAM expertise of the broader team.
About You
Basic Qualifications
10+ years in cloud security or IAM, including 3+ years in staff, or architect role owning technical direction.
Deep AWS IAM expertise: multi-account Organizations, SCPs, IAM Identity Center, ABAC, and secrets management (AWS Secrets Manager, HashiCorp Vault, or similar).
