Principal Cybersecurity Engineer - Enterprise Security Engineering

We’re obsessed with making hard work pay off, for our people, our customers, and the world around us. As a Fortune 500 company and a leading AI platform for managing people, money, and agents, we’re shaping the future of work so teams can reach their potential and focus on what matters most. The minute you join, you’ll feel it. Not just in the products we build, but in how we show up for each other. Our culture is rooted in integrity, empathy, and shared enthusiasm. We’re in this together, tackling big challenges with bold ideas and genuine care. We look for curious minds and courageous collaborators who bring sun-drenched optimism and drive. Whether you're building smarter solutions, supporting customers, or creating a space where everyone belongs, you’ll do meaningful work with Workmates who’ve got your back. In return, we’ll give you the trust to take risks, the tools to grow, the skills to develop and the support of a company invested in you for the long haul. So, if you want to inspire a brighter work day for everyone, including yourself, you’ve found a match in Workday, and we hope to be a match for you too.

As a Principal Cybersecurity Engineer on the Enterprise Security Engineering team, you will serve as a senior technical authority across our corporate endpoint fleet and an architect of our broader security engineering strategy. This role exists at the critical intersection of core endpoint infrastructure, workmate enablement, and agentic AI automation — and your work will have a direct impact on the security posture of Workday's entire enterprise environment.

You will set the technical vision and architectural standards for endpoint privilege management and least-privilege enforcement across macOS and Windows. You will design scalable, low-friction application control frameworks that maintain security baselines while preserving developer agility.

A defining pillar of this role is engineering enablement and mentorship. You will actively guide and coach associate and mid-level engineers across their respective platform domains, helping them build deep technical depth, navigate complex challenges, and grow as security professionals.

Responsibilities:

• Set the technical vision, architectural standards, and execution boundaries for endpoint privilege management and least-privilege enforcement across macOS and Windows fleets.
• Design scalable application control frameworks that maintain security baselines while preserving developer agility and execution velocity.
• Architect and manage application control and runtime guardrail frameworks to govern developer tools, IDE extensions, local AI coding assistants, and open-source package dependencies under least-privilege models.
• Establish enterprise authorization thresholds and runtime safeguards to enable safe AI adoption.
• Guide the architectural strategy and technical implementation of automated intake, research, and policy-staging pipelines for application evaluations, developer exception triage, and security review workflows.
• Drive telemetry correlation and integration architectures linking endpoint privilege controls with SaaS posture signals (SSPM), threat detection pipelines (EDR), and central automation servers.
• Provide architectural oversight and direction across EDR and SSPM platforms, advising engineering leads on detection models, configuration posture, and threat surface reduction.
• Bridge device telemetry and posture signals with enterprise asset correlation tools and cross-pillar orchestration layers.
• Serve as a dedicated technical mentor and coach to junior and mid-level engineers, helping them build technical depth, navigate operational challenges, and advance their careers.
• Lead technical design reviews, champion engineering best practices, and establish high standards for maintainability, documentation, and operational rigor.
• Partner with security engineering leadership to assess technical skills, identify growth opportunities, and elevate team-wide execution capabilities.
• Act as a principal advisor to engineering leadership, contributing to multi-quarter technical roadmaps and enterprise security investments.
• Lead technical engagements and roadmap alignment with enterprise security vendors.
• Serve as the ultimate technical escalation authority for tier-3 troubleshooting.

• 8+ years of progressive cybersecurity engineering experience, with significant time spent operating in a Principal, Staff, or Lead architectural capacity in enterprise environments.
• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related discipline, or equivalent practical experience.
• At least one industry-recognized advanced certification such as CISSP, GIAC Advanced Certification (e.g., GSEC, GDSA, or GCIA), OSCP, or vendor-equivalent architectural credentials.

• Endpoint Domain Expertise: Deep subject-matter expertise in architecting and governing enterprise Endpoint Privilege Management platforms at scale across large corporate fleets. This includes a comprehensive understanding of macOS and Windows security architectures, execution controls, code integrity, and privilege boundaries.
• AI and Developer Governance: Experience architecting security controls for modern developer environments, including developer tooling, IDE ecosystems, and emerging AI coding assistants and local models. Ability to establish runtime guardrails and authorization thresholds that enable safe adoption of new technologies.
• Cross-Domain Security Breadth: Familiarity with modern enterprise EDR platforms and SSPM frameworks, including detection principles, posture management, and API-driven automation pipelines. Ability to bridge device telemetry and posture signals across multiple security domains.
• Security Engineering and Architecture: Experience designing secure, scalable systems and implementing security measures that protect information and infrastructure from unauthorized access. Ability to develop robust data protection strategies, conduct security audits, and build incident response plans.
• Technical Mentorship: A genuine passion for mentoring, coaching, and elevating early-in-career and mid-level engineers across security domains. Experience fostering a supportive learning environment, providing constructive feedback, and helping team members maximize their potential and advance their careers.
• Communication and Collaboration: Exceptional communication skills with an ability to influence senior technical leadership, explain nuanced security trade-offs clearly, and foster collaborative relationships across cross-functional teams. Comfortable contributing to multi-quarter technical roadmaps and representing security engineering in vendor and leadership discussions.

Listed below is the base salary range applicable to this position. Workday pay ranges (and the precise pay offered to the successful candidate) are based on a number of objective criteria such as relevant experience and skills, and educational qualifications, level of responsibility, demands of the role, work location and business need. As a part of the total compensation package, this role may be eligible for the Workday Bonus Plan or a role-specific commission/bonus, as well as annual refresh stock grants awarded by Workday Inc. For more information regarding Workday’s comprehensive benefits, please click here.

At Workday, we value our candidates’ privacy and data security.  Workday will never ask candidates to apply to jobs through websites that are not Workday Careers. 

Please be aware of sites that may ask for you to input your data in connection with a job posting that appears to be from Workday but is not.

In addition, Workday will never ask candidates to pay a recruiting fee, or pay for consulting or coaching services, in order to apply for a job at Workday.