Principal Cybersecurity Engineer - Enterprise Security Engineering

Your work days are brighter here.

We’re obsessed with making hard work pay off, for our people, our customers, and the world around us. As a Fortune 500 company and a leading AI platform for managing people, money, and agents, we’re shaping the future of work so teams can reach their potential and focus on what matters most. The minute you join, you’ll feel it. Not just in the products we build, but in how we show up for each other. Our culture is rooted in integrity, empathy, and shared enthusiasm. We’re in this together, tackling big challenges with bold ideas and genuine care. We look for curious minds and courageous collaborators who bring sun-drenched optimism and drive. Whether you're building smarter solutions, supporting customers, or creating a space where everyone belongs, you’ll do meaningful work with Workmates who’ve got your back. In return, we’ll give you the trust to take risks, the tools to grow, the skills to develop and the support of a company invested in you for the long haul. So, if you want to inspire a brighter work day for everyone, including yourself, you’ve found a match in Workday, and we hope to be a match for you too.

About the Team

The Enterprise Security Engineering team is the frontline of Workday's enterprise defense, ensuring that our global corporate environment remains secure, resilient, and ready to support the pace of innovation across the company. We sit at the intersection of endpoint infrastructure, developer enablement, and security automation - protecting Workday's corporate fleet while empowering our engineering community to build and ship with confidence.

Our work spans endpoint privilege management, endpoint detection and response (EDR), SaaS security posture management (SSPM), and the governance of developer tools and emerging AI technologies. In the year ahead, the team will focus on expanding agentic automation pipelines, evolving our application control frameworks to support safe AI adoption, and deepening cross-pillar integration between endpoint, SaaS posture, and threat detection systems.

What makes this team special is our commitment to engineering excellence and to each other. We invest deeply in mentorship and talent development, helping engineers at every level grow their technical depth and take ownership of their domains. If you enjoy solving meaningful security challenges alongside a collaborative, forward-thinking group, this team is for you.

About the Role

As a Principal Cybersecurity Engineer on the Enterprise Security Engineering team, you will serve as a senior technical authority across our corporate endpoint fleet and an architect of our broader security engineering strategy. This role exists at the critical intersection of core endpoint infrastructure, workmate enablement, and agentic AI automation - and your work will have a direct impact on the security posture of Workday's entire enterprise environment.

You will set the technical vision and architectural standards for endpoint privilege management and least-privilege enforcement across macOS and Windows. You will design scalable, low-friction application control frameworks that maintain security baselines while preserving developer agility.

A defining pillar of this role is engineering enablement and mentorship. You will actively guide and coach associate and mid-level engineers across their respective platform domains, helping them build deep technical depth, navigate complex challenges, and grow as security professionals.

Responsibilities:

• Set the technical vision, architectural standards, and execution boundaries for endpoint privilege management and least-privilege enforcement across macOS and Windows fleets.
• Design scalable application control frameworks that maintain security baselines while preserving developer agility and execution velocity.
• Architect and manage application control and runtime guardrail frameworks to govern developer tools, IDE extensions, local AI coding assistants, and open-source package dependencies under least-privilege models.
• Establish enterprise authorization thresholds and runtime safeguards to enable safe AI adoption.
• Guide the architectural strategy and technical implementation of automated intake, research, and policy-staging pipelines for application evaluations, developer exception triage, and security review workflows.
• Drive telemetry correlation and integration architectures linking endpoint privilege controls with SaaS posture signals (SSPM), threat detection pipelines (EDR), and central automation servers.
• Provide architectural oversight and direction across EDR and SSPM platforms, advising engineering leads on detection models, configuration posture, and threat surface reduction.
• Bridge device telemetry and posture signals with enterprise asset correlation tools and cross-pillar orchestration layers.
• Serve as a dedicated technical mentor and coach to junior and mid-level engineers, helping them build technical depth, navigate operational challenges, and advance their careers.
• Lead technical design reviews, champion engineering best practices, and establish high standards for maintainability, documentation, and operational rigor.
• Partner with security engineering leadership to assess technical skills, identify growth opportunities, and elevate team-wide execution capabilities.
• Act as a principal advisor to engineering leadership, contributing to multi-quarter technical roadmaps and enterprise security investments.
• Lead technical engagements and roadmap alignment with enterprise security vendors.
• Serve as the ultimate technical escalation authority for tier-3 troubleshooting.

About You

Basic Qualifications

• 8+ years of progressive cybersecurity engineering experience, with significant time spent operating in a Principal, Staff, or Lead architectural capacity in enterprise environments.
• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related discipline, or equivalent practical experience.
• At least one industry-recognized advanced certification such as CISSP, GIAC Advanced Certification (e.g., GSEC, GDSA, or GCIA), OSCP, or vendor-equivalent architectural credentials.

Other Qualifications

• Endpoint Domain Expertise: Deep subject-matter expertise in architecting and governing enterprise Endpoint Privilege Management platforms at scale across large corporate fleets. This includes a comprehensive understanding of macOS and Windows security architectures, execution controls, code integrity, and privilege boundaries.
• AI and Developer Governance: Experience architecting security controls for modern developer environments, including developer tooling, IDE ecosystems, and emerging AI coding assistants and local models. Ability to establish runtime guardrails and authorization thresholds that enable safe adoption of new technologies.
• Cross-Domain Security Breadth: Familiarity with modern enterprise EDR platforms and SSPM frameworks, including detection principles, posture management, and API-driven automation pipelines. Ability to bridge device telemetry and posture signals across multiple security domains.
• Security Engineering and Architecture: Experience designing secure, scalable systems and implementing security measures that protect information and infrastructure from unauthorized access. Ability to develop robust data protection strategies, conduct security audits, and build incident response plans.
• Technical Mentorship: A genuine passion for mentoring, coaching, and elevating early-in-career and mid-level engineers across security domains. Experience fostering a supportive learning environment, providing constructive feedback, and helping team members maximize their potential and advance their careers.
• Communication and Collaboration: Exceptional communication skills with an ability to influence senior technical leadership, explain nuanced security trade-offs clearly, and foster collaborative relationships across cross-functional teams. Comfortable contributing to multi-quarter technical roadmaps and representing security engineering in vendor and leadership discussions.

Workday Pay Transparency Statement (For EU Locations Only)

Listed below is the base salary range applicable to this position. Workday pay ranges (and the precise pay offered to the successful candidate) are based on a number of objective criteria such as relevant experience and skills, and educational qualifications, level of responsibility, demands of the role, work location and business need. As a part of the total compensation package, this role may be eligible for the Workday Bonus Plan or a role-specific commission/bonus, as well as annual refresh stock grants awarded by Workday Inc. For more information regarding Workday’s comprehensive benefits, please click here.

Our Approach to Flexible Work

With Flex Work, we’re combining the best of both worlds: in-person time and remote. Our approach enables our teams to deepen connections, maintain a strong community, and do their best work. We know that flexibility can take shape in many ways, so rather than a number of required days in-office each week, we simply spend at least half (50%) of our time each quarter in the office or in the field with our customers, prospects, and partners (depending on role). This means you'll have the freedom to create a flexible schedule that caters to your business, team, and personal needs, while being intentional to make the most of time spent together. Those in our remote "home office" roles also have the opportunity to come together in our offices for important moments that matter.

Pursuant to applicable Fair Chance law, Workday will consider for employment qualified applicants with arrest and conviction records.

Workday is an Equal Opportunity Employer including individuals with disabilities and protected veterans.

Workday is committed to providing reasonable accommodations for qualified individuals during our application process, in order to perform one or more essential functions of their job, as well as regarding the use of AI tools for employment decision-making to any degree. Please see below for more details including how to request an accommodation as a qualified veteran, due to a disability or for religious reasons, or as otherwise provided under applicable law.

Workday prohibits taking adverse action against any candidate or employee for reporting a possible violation of this policy, requesting one or more work accommodations, exercising a privacy right, or cooperating in an investigation in accordance with applicable law. Any employee who retaliates against a candidate or employee for doing so may be subject to disciplinary action, up to and including termination of employment, to the fullest extent allowable under applicable law.

If you require a reasonable accommodation, you may email [email protected], as far in advance as possible.

Are you being referred to one of our roles? If so, ask your connection at Workday about our Employee Referral process!

At Workday, we value our candidates’ privacy and data security. Workday will never ask candidates to apply to jobs through websites that are not Workday Careers.

Please be aware of sites that may ask for you to input your data in connection with a job posting that appears to be from Workday but is not.

In addition, Workday will never ask candidates to pay a recruiting fee, or pay for consulting or coaching services, in order to apply for a job at Workday.