Principal Cybersecurity Engineer - Enterprise Security Engineering

About the job

Your work days are brighter here.

We’re obsessed with making hard work pay off, for our people, our customers, and the world around us. As a Fortune 500 company and a leading AI platform for managing people, money, and agents, we’re shaping the future of work so teams can reach their potential and focus on what matters most. The minute you join, you’ll feel it. Not just in the products we build, but in how we show up for each other. Our culture is rooted in integrity, empathy, and shared enthusiasm. We’re in this together, tackling big challenges with bold ideas and genuine care. We look for curious minds and courageous collaborators who bring sun-drenched optimism and drive. Whether you're building smarter solutions, supporting customers, or creating a space where everyone belongs, you’ll do meaningful work with Workmates who’ve got your back. In return, we’ll give you the trust to take risks, the tools to grow, the skills to develop and the support of a company invested in you for the long haul. So, if you want to inspire a brighter work day for everyone, including yourself, you’ve found a match in Workday, and we hope to be a match for you too.

About the Team

The Enterprise Security Engineering team is the frontline of Workday's enterprise defense, ensuring that our global corporate environment remains secure, resilient, and ready to support the pace of innovation across the company. We sit at the intersection of endpoint infrastructure, developer enablement, and security automation — protecting Workday's corporate fleet while empowering our engineering community to build and ship with confidence.
Our work spans endpoint privilege management, endpoint detection and response (EDR), SaaS security posture management (SSPM), and the governance of developer tools and emerging AI technologies. In the year ahead, the team will focus on expanding agentic automation pipelines, evolving our application control frameworks to support safe AI adoption, and deepening cross-pillar integration between endpoint, SaaS posture, and threat detection systems.
What makes this team special is our commitment to engineering excellence and to each other. We invest deeply in mentorship and talent development, helping engineers at every level grow their technical depth and take ownership of their domains. If you enjoy solving meaningful security challenges alongside a collaborative, forward-thinking group, this team is for you.

About the Role

As a Principal Cybersecurity Engineer on the Enterprise Security Engineering team, you will serve as a senior technical authority across our corporate endpoint fleet and an architect of our broader security engineering strategy. This role exists at the critical intersection of core endpoint infrastructure, workmate enablement, and agentic AI automation — and your work will have a direct impact on the security posture of Workday's entire enterprise environment.

You will set the technical vision and architectural standards for endpoint privilege management and least-privilege enforcement across macOS and Windows. You will design scalable, low-friction application control frameworks that maintain security baselines while preserving developer agility.

A defining pillar of this role is engineering enablement and mentorship. You will actively guide and coach associate and mid-level engineers across their respective platform domains, helping them build deep technical depth, navigate complex challenges, and grow as security professionals.

Responsibilities:

• Set the technical vision, architectural standards, and execution boundaries for endpoint privilege management and least-privilege enforcement across macOS and Windows fleets.
• Design scalable application control frameworks that maintain security baselines while preserving developer agility and execution velocity.
• Architect and manage application control and runtime guardrail frameworks to govern developer tools, IDE extensions, local AI coding assistants, and open-source package dependencies under least-privilege models.
• Establish enterprise authorization thresholds and runtime safeguards to enable safe AI adoption.
• Guide the architectural strategy and technical implementation of automated intake, research, and policy-staging pipelines for application evaluations, developer exception triage, and security review workflows.
• Drive telemetry correlation and integration architectures linking endpoint privilege controls with SaaS posture signals (SSPM), threat detection pipelines (EDR), and central automation servers.
• Provide architectural oversight and direction across EDR and SSPM platforms, advising engineering leads on detection models, configuration posture, and threat surface reduction.
• Bridge device telemetry and posture signals with enterprise asset correlation tools and cross-pillar orchestration layers.
• Serve as a dedicated technical mentor and coach to junior and mid-level engineers, helping them build technical depth, navigate operational challenges, and advance their careers.
• Lead technical design reviews, champion engineering best practices, and establish high standards for maintainability, documentation, and operational rigor.
• Partner with security engineering leadership to assess technical skills, identify growth opportunities, and elevate team-wide execution capabilities.
• Act as a principal advisor to engineering leadership, contributing to multi-quarter technical roadmaps and enterprise security investments.
• Lead technical engagements and roadmap alignment with enterprise security vendors.
• Serve as the ultimate technical escalation authority for tier-3 troubleshooting.

About You

Basic Qualifications

• 8+ years of progressive cybersecurity engineering experience, with significant time spent operating in a Principal, Staff, or Lead architectural capacity in enterprise environments.
• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related discipline, or equivalent practical experience.
• At least one industry-recognized advanced certification such as CISSP, GIAC Advanced Certification (e.g., GSEC, GDSA, or GCIA), OSCP, or vendor-equivalent architectural credentials.

Other Qualifications