Principal Cloud Security Engineer, Identity & Access (IAM)

We’re obsessed with making hard work pay off, for our people, our customers, and the world around us. As a Fortune 500 company and a leading AI platform for managing people, money, and agents, we’re shaping the future of work so teams can reach their potential and focus on what matters most. The minute you join, you’ll feel it. Not just in the products we build, but in how we show up for each other. Our culture is rooted in integrity, empathy, and shared enthusiasm. We’re in this together, tackling big challenges with bold ideas and genuine care. We look for curious minds and courageous collaborators who bring sun-drenched optimism and drive. Whether you're building smarter solutions, supporting customers, or creating a space where everyone belongs, you’ll do meaningful work with Workmates who’ve got your back. In return, we’ll give you the trust to take risks, the tools to grow, the skills to develop and the support of a company invested in you for the long haul. So, if you want to inspire a brighter work day for everyone, including yourself, you’ve found a match in Workday, and we hope to be a match for you too.

 Identity is Workday's most important security boundary. It protects the personal data of 60+ million people and the financial data of some of the world's largest companies. Our identity surface spans multi-account AWS, enterprise SaaS, a global workforce, and a fast-growing set of AI agents and workloads.

We're looking for a Principal engineer to own the strategy and architecture of our IAM program. You'll set the patterns other engineers build against and make the calls that determine how we scale. You'll also help define how to secure AI agents in production, a problem the industry is still working out.

This is a strategic, hands-on architecture role, not an operations role. You'll work directly with engineering, security, and Risk leadership, and you'll have real influence over the direction of identity at Workday.

What you'll do

• Own the multi-year IAM architecture and roadmap across human and non-human identity, cloud authorization, federation, and secrets management.
• Design and evolve AWS identity at scale, including Organizations, SCPs, IAM Identity Center, ABAC, and least-privilege patterns across hundreds of accounts.
• Architect workforce identity: SSO, adaptive MFA, SCIM provisioning, and lifecycle automation.
• Define identity patterns for AI agents and service-to-service workloads, including how they authenticate, what they can assume, and how their actions are observed and governed.
• Drive Zero Trust in practice through identity-aware access, conditional policies, and workload-level controls.
• Embed identity guardrails into Terraform and CI/CD so secure is the default path.
• Partner with Risk and GRC to turn threat exposure into pragmatic decisions, and push back on controls that add friction without reducing risk.
• Mentor engineers and raise the IAM expertise of the broader team.

• 0+ years in cloud security or IAM, including 3+ years in staff, or architect role owning technical direction.
• Deep AWS IAM expertise: multi-account Organizations, SCPs, IAM Identity Center, ABAC, and secrets management (AWS Secrets Manager, HashiCorp Vault, or similar).
• Enterprise workforce identity experience with Okta or an equivalent platform (Entra ID, Ping, etc.), including SSO, MFA, SCIM, and lifecycle management.
• Strong working knowledge of SAML, OIDC, and OAuth2, including debugging them in complex environments.
• Terraform fluency and an understanding of how identity controls are enforced through CI/CD.
• A track record of driving alignment across engineering, security, and business teams without positional authority.

• Hands-on work with AI/agentic or non-human identity: NHI lifecycle, workload identity, least privilege for agents that assume roles and chain API calls. If you've started exploring this space, we want to talk to you.
• Experience with identity-aware proxies, agent observability, or LLM access governance tooling.
• GCP or multi-cloud identity experience.
• AWS Certified Security – Specialty.

The annualized base salary ranges for the primary location and any additional locations are listed below.  Workday pay ranges vary based on work location. As a part of the total compensation package, this role may be eligible for the Workday Bonus Plan or a role-specific commission/bonus, as well as annual refresh stock grants. Recruiters can share more detail during the hiring process. Each candidate’s compensation offer will be based on multiple factors including, but not limited to, geography, experience, skills, job duties, and business need, among other things. For more information regarding Workday’s comprehensive benefits, please click here.

At Workday, we value our candidates’ privacy and data security.  Workday will never ask candidates to apply to jobs through websites that are not Workday Careers. 

Please be aware of sites that may ask for you to input your data in connection with a job posting that appears to be from Workday but is not.

In addition, Workday will never ask candidates to pay a recruiting fee, or pay for consulting or coaching services, in order to apply for a job at Workday.