Principal Cloud Security Engineer, Identity & Access (IAM)

About the Team

Workday's Cybersecurity & Trust organization exists to inspire confidence and trust in Workday. We safeguard the personal information of 60+ million people and the financial information of some of the largest companies in the world. Cybersecurity is woven into the fabric of Workday and is core to everything we do. We nurture a security-first mentality and believe that moving with speed and velocity is enabled by building security into the foundation. Build the future of Cybersecurity at Workday by applying innovative technology to a customer-centric platform!
The Workday Enterprise Security team safeguards Workday's vital data, infrastructure, and applications through authority, technical solutions, and risk mitigation across all enterprise systems, concentrating on security architecture, engineering, and infrastructure. We select, engineer, and lead a robust suite of technical controls to actively prevent, detect, and respond to threats. Ultimately, Enterprise Security acts as the central line of defense, proactively leading security posture, ensuring operational resilience, and maintaining customer trust in Workday's dedication to security excellence.
Within Enterprise Security, the Enterprise Identity team is where identity meets impact. We own and evolve the Identity and Access Management systems that serve as Workday's first and most critical line of defense governing who gets access, to what, and why. From zero-trust architecture and privileged access governance to identity lifecycle automation and federation at scale, we operate across one of the most complex enterprise environments in cloud software. As a Principal IAM Engineer here, you'll architect bold solutions, challenge assumptions, and drive decisions that protect Workday at its core. If you're energized by hard problems at the intersection of identity, security, and engineering excellence, this is where you belong.

About the Role

Identity is Workday's most important security boundary. It protects the personal data of 60+ million people and the financial data of some of the world's largest companies. Our identity surface spans multi-account AWS, enterprise SaaS, a global workforce, and a fast-growing set of AI agents and workloads.

We're looking for a Principal engineer to own the strategy and architecture of our IAM program. You'll set the patterns other engineers build against and make the calls that determine how we scale. You'll also help define how to secure AI agents in production, a problem the industry is still working out.

This is a strategic, hands-on architecture role, not an operations role. You'll work directly with engineering, security, and Risk leadership, and you'll have real influence over the direction of identity at Workday.

What you'll do

• Own the multi-year IAM architecture and roadmap across human and non-human identity, cloud authorization, federation, and secrets management.
• Design and evolve AWS identity at scale, including Organizations, SCPs, IAM Identity Center, ABAC, and least-privilege patterns across hundreds of accounts.
• Architect workforce identity: SSO, adaptive MFA, SCIM provisioning, and lifecycle automation.
• Define identity patterns for AI agents and service-to-service workloads, including how they authenticate, what they can assume, and how their actions are observed and governed.
• Drive Zero Trust in practice through identity-aware access, conditional policies, and workload-level controls.
• Embed identity guardrails into Terraform and CI/CD so secure is the default path.
• Partner with Risk and GRC to turn threat exposure into pragmatic decisions, and push back on controls that add friction without reducing risk.
• Mentor engineers and raise the IAM expertise of the broader team.

About You

Basic Qualifications

• 0+ years in cloud security or IAM, including 3+ years in staff, or architect role owning technical direction.
• Deep AWS IAM expertise: multi-account Organizations, SCPs, IAM Identity Center, ABAC, and secrets management (AWS Secrets Manager, HashiCorp Vault, or similar).
• Enterprise workforce identity experience with Okta or an equivalent platform (Entra ID, Ping, etc.), including SSO, MFA, SCIM, and lifecycle management.
• Strong working knowledge of SAML, OIDC, and OAuth2, including debugging them in complex environments.
• Terraform fluency and an understanding of how identity controls are enforced through CI/CD.
• A track record of driving alignment across engineering, security, and business teams without positional authority.

Other Qualifications

• Hands-on work with AI/agentic or non-human identity: NHI lifecycle, workload identity, least privilege for agents that assume roles and chain API calls. If you've started exploring this space, we want to talk to you.
• Experience with identity-aware proxies, agent observability, or LLM access governance tooling.
• GCP or multi-cloud identity experience.
• AWS Certified Security – Specialty.

Workday Pay Transparency Statement

The annualized base salary ranges for the primary location and any additional locations are listed below. Workday pay ranges vary based on work location. As a part of the total compensation package, this role may be eligible for the Workday Bonus Plan or a role-specific commission/bonus, as well as annual refresh stock grants. Recruiters can share more detail during the hiring process. Each candidate’s compensation offer will be based on multiple factors including, but not limited to, geography, experience, skills, job duties, and business need, among other things. For more information regarding Workday’s comprehensive benefits, please click here.

Primary Location: USA.VA.Reston

Primary Location Base Pay Range: $184,800 USD - $277,200 USD

Additional US Location(s) Base Pay Range: $167,200 USD - $300,000 USD

Our Approach to Flexible Work

With Flex Work, we’re combining the best of both worlds: in-person time and remote. Our approach enables our teams to deepen connections, maintain a strong community, and do their best work. We know that flexibility can take shape in many ways, so rather than a number of required days in-office each week, we simply spend at least half (50%) of our time each quarter in the office or in the field with our customers, prospects, and partners (depending on role). This means you'll have the freedom to create a flexible schedule that caters to your business, team, and personal needs, while being intentional to make the most of time spent together. Those in our remote "home office" roles also have the opportunity to come together in our offices for important moments that matter.

Pursuant to applicable Fair Chance law, Workday will consider for employment qualified applicants with arrest and conviction records.

Workday is an Equal Opportunity Employer including individuals with disabilities and protected veterans.

Workday is committed to providing reasonable accommodations for qualified individuals during our application process, in order to perform one or more essential functions of their job, as well as regarding the use of AI tools for employment decision-making to any degree. Please see below for more details including how to request an accommodation as a qualified veteran, due to a disability or for religious reasons, or as otherwise provided under applicable law.

Workday prohibits taking adverse action against any candidate or employee for reporting a possible violation of this policy, requesting one or more work accommodations, exercising a privacy right, or cooperating in an investigation in accordance with applicable law. Any employee who retaliates against a candidate or employee for doing so may be subject to disciplinary action, up to and including termination of employment, to the fullest extent allowable under applicable law.

If you require a reasonable accommodation, you may email accommodations@workday.com, as far in advance as possible.

Are you being referred to one of our roles? If so, ask your connection at Workday about our Employee Referral process!

At Workday, we value our candidates’ privacy and data security. Workday will never ask candidates to apply to jobs through websites that are not Workday Careers.

Please be aware of sites that may ask for you to input your data in connection with a job posting that appears to be from Workday but is not.

In addition, Workday will never ask candidates to pay a recruiting fee, or pay for consulting or coaching services, in order to apply for a job at Workday.