Principal Software Engineer - Veza

ServiceNow•San Diego, CA

1d•$199,100 - $348,400

About The Position

Veza, part of ServiceNow’s Security & Risk organization, is hiring a Principal Software Engineer to shape identity architecture for its Agent Security roadmap. The role focuses on identity for workloads and AI agents, including trust domains, workload attestation, identity issuance and lifecycle, ephemeral credentials, delegated access, runtime authorization, and auditability. The position defines identity contracts and standards for Veza’s graph, data model, integrations, and services, and helps shape identity’s place in the Veza-ServiceNow integration model. It partners with integration, graph, and deployment owners while leaving ownership of their domains with them. The role also represents Veza’s identity architecture to customers, partners, ServiceNow Security leadership, and standards bodies, and mentors engineers. Success in the first 12 months includes publishing an identity architecture for workload and agent access with committed milestones, establishing an adopted ephemeral credential model across services and integrations, designing runtime authorization for agents that Product and Sales can present to customers, and agreeing on identity contracts with graph, integration, and deployment owners.

Requirements

12+ years of experience in security or identity engineering, with a substantial share designing production identity systems at scale.
Strong background in identity and access, such as IGA, IAM, PAM, authorization models, access reviews, lifecycle management, or adjacent security domains.
Deep hands-on expertise in workload identity, specifically SPIFFE/SPIRE or an equivalent, and ephemeral credential design, including trust bootstrapping and rotation failure modes.
Strong grounding in OAuth 2.x, OIDC, token exchange, and authorization models such as RBAC, ABAC, ReBAC, and policy engines such as OPA or Cedar.
Understanding of non-human identities, including service accounts, secrets, API keys, and workload identity, as well as emerging agent identity and authorization models.
Experience building security products that meet security and compliance standards such as SOC 2, FedRAMP, or equivalent, and data residency requirements.
Experience delivering production AI or agentic systems, including evaluation, guardrails, and human-in-the-loop controls.
Active use of AI-native development tools such as Claude Code, Cursor, Codex, or equivalent.
Strong Python or Go skills and ability to contribute deeply to code and design reviews.
Executive-level communication skills, including the ability to defend identity decisions to engineers, customers, and security leadership.
Breadth to engage with graph data models, integration architecture, and multi-region deployment.

Nice To Haves

Experience integrating an acquired architecture with a parent platform through an acquisition or platform integration.
Experience with integration-heavy platforms and their authentication and secrets challenges.
Familiarity with graph databases or immutable or event-sourced storage models.
Authored or shaped identity standards or RFCs.
Built or operated a production credential broker or identity provider.
BS/MS in Computer Science or a related field, or equivalent experience.

Responsibilities

Own the identity model for workloads and agents, including SPIFFE/SPIRE trust domains, workload attestation, and identity issuance, scoping, rotation, and revocation.
Architect end-to-end ephemeral authentication and authorization, including short-lived credential issuance, token exchange and delegation, and effective revocation.
Define runtime authorization for agents, including accessible resources, delegated authority, guardrails, and audit trails.
Lead identity architecture for the Agent Security roadmap, including Runtime Authorization, the Access Policy Engine, AgentID with short-lived credentials, and integration with the NHI program.
Set identity standards for non-human identities across Veza integrations, including connector authentication, scoping, and secret rotation.
Define identity contracts for graph, data model, and integrations architects, and review designs for identity correctness.
Shape identity’s role in the Veza-ServiceNow integration model, including shared identity and data contracts and UI surfacing patterns.
Partner with integration, graph, and deployment owners on decisions that affect identity without taking over their domains.
Represent Veza’s identity architecture to customers, partners, ServiceNow Security leadership, and standards bodies.
Mentor engineers.