Principal Cybersecurity Engineer - Enterprise Security Engineering

Workday • Atlanta, GA

4d • €104,000 - €156,000 • Hybrid

About The Position

As a Principal Cybersecurity Engineer on Workday’s Enterprise Security Engineering team, you will serve as a senior technical authority for the corporate endpoint fleet and help architect the broader security engineering strategy. The role operates at the intersection of endpoint infrastructure, workmate enablement, and agentic AI automation, with direct impact on the security of Workday’s enterprise environment.

You will set technical vision and architectural standards for endpoint privilege management and least-privilege enforcement across macOS and Windows, while designing scalable application control frameworks that maintain security baselines without impeding developer agility. You will also guide safe governance of developer tools and AI technologies, connect endpoint controls with SaaS posture and threat-detection systems, and develop automation for security intake and review workflows.

A central part of the role is mentoring and enabling associate and mid-level engineers. You will lead design reviews, advise engineering leadership, contribute to multi-quarter roadmaps and enterprise investments, engage with security vendors, and serve as the ultimate technical escalation authority for tier-3 troubleshooting. Workday describes its work arrangement as Flex Work: teams spend at least half of each quarter in the office or in the field, while remote home-office roles may also join office gatherings for important moments.

Requirements

• At least 8 years of progressive cybersecurity engineering experience, including significant time in a Principal, Staff, or Lead architectural capacity in enterprise environments.
• Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, or a related discipline, or equivalent practical experience.
• At least one industry-recognized advanced certification, such as CISSP, a GIAC advanced certification (e.g., GSEC, GDSA, or GCIA), OSCP, or vendor-equivalent architectural credentials.
• Deep expertise architecting and governing enterprise Endpoint Privilege Management platforms at scale across large corporate fleets.
• Comprehensive understanding of macOS and Windows security architectures, execution controls, code integrity, and privilege boundaries.
• Experience designing security controls for developer environments, including developer tooling, IDE ecosystems, AI coding assistants, and local models; ability to establish runtime guardrails and authorization thresholds.
• Familiarity with enterprise EDR platforms and SSPM frameworks, including detection principles, posture management, and API-driven automation pipelines.
• Ability to connect device telemetry and posture signals across multiple security domains.
• Experience designing secure, scalable systems and implementing protections against unauthorized access; ability to develop data protection strategies, conduct security audits, and build incident response plans.
• Experience mentoring, coaching, and elevating early-career and mid-level engineers, including providing constructive feedback and fostering a supportive learning environment.
• Exceptional communication skills and ability to influence senior technical leadership, explain security trade-offs, collaborate across functions, contribute to technical roadmaps, and represent security engineering in vendor and leadership discussions.

Responsibilities

• Set technical vision, architectural standards, and execution boundaries for endpoint privilege management and least-privilege enforcement across macOS and Windows fleets.
• Design scalable application control frameworks that maintain security baselines while preserving developer agility and execution velocity.
• Architect and manage application control and runtime guardrail frameworks for developer tools, IDE extensions, local AI coding assistants, and open-source package dependencies under least-privilege models.
• Establish enterprise authorization thresholds and runtime safeguards to enable safe AI adoption.
• Guide the design and implementation of automated intake, research, and policy-staging pipelines for application evaluations, developer exception triage, and security review workflows.
• Drive telemetry correlation and integration architectures connecting endpoint privilege controls with SSPM signals, EDR threat-detection pipelines, and central automation servers.
• Provide architectural oversight and direction across EDR and SSPM platforms, advising engineering leads on detection models, configuration posture, and threat surface reduction.
• Bridge device telemetry and posture signals with enterprise asset correlation tools and cross-pillar orchestration layers.
• Mentor and coach junior and mid-level engineers, helping them develop technical depth, handle operational challenges, and advance their careers.
• Lead technical design reviews, champion engineering best practices, and establish standards for maintainability, documentation, and operational rigor.
• Partner with security engineering leadership to assess technical skills, identify growth opportunities, and improve team-wide execution capabilities.
• Advise engineering leadership and contribute to multi-quarter technical roadmaps and enterprise security investments.
• Lead technical engagements and roadmap alignment with enterprise security vendors.
• Serve as the ultimate technical escalation authority for tier-3 troubleshooting.

Benefits

• The role may be eligible for the Workday Bonus Plan or a role-specific commission/bonus.
• Annual refresh stock grants may be awarded by Workday Inc.
• Flexible work arrangements, including the ability to create a flexible schedule and remote home-office roles’ opportunity to attend important gatherings in Workday offices.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal