Principal Software Engineer - Veza

ServiceNow•San Diego, CA

About The Position

Veza, part of ServiceNow’s Security & Risk organization, is hiring a Principal Software Engineer to shape identity architecture for its identity security platform and Agent Security roadmap. The role focuses on workload and agent identity, ephemeral credentials, runtime authorization, and identity standards across integrations. The engineer will define identity contracts and collaborate with graph, integrations, and deployment owners while respecting their areas of ownership. The position also represents Veza’s identity architecture to customers, partners, ServiceNow leadership, and standards bodies, and includes mentoring engineers. Success in the first 12 months means publishing an identity architecture for workload and agent access with committed milestones; defining and adopting an ephemeral-credentials model across Veza services and integrations; delivering a runtime authorization design for agents that Product and Sales can present to customers; and agreeing on identity contracts with graph, integrations, and deployment owners.

Requirements

12+ years in security or identity engineering, with a substantial share designing identity systems in production at scale.
Strong background in identity and access, such as IGA, IAM, PAM, authorization models, access reviews, lifecycle management, or adjacent security domains.
Deep hands-on expertise in workload identity, specifically SPIFFE/SPIRE or an equivalent, and ephemeral credential design.
Strong grounding in OAuth 2.x, OIDC, token exchange, and authorization models such as RBAC, ABAC, ReBAC, and policy engines such as OPA or Cedar.
Understanding of non-human identity, including service accounts, secrets, API keys, and workload identity, as well as emerging agent identity and authorization models.
Experience building security products that meet security and compliance requirements such as SOC 2, FedRAMP, or equivalent, and data residency.
Experience delivering production AI or agentic systems, including evaluation, guardrails, and human-in-the-loop controls.
Active use of AI-native development tools such as Claude Code, Cursor, Codex, or equivalent.
Strong Python or Go skills, with the ability to work deeply in code and design reviews.
Executive-level communication skills, including the ability to defend identity decisions to engineers, customers, and security leadership.
Breadth to engage with graph data models, integration architecture, and multi-region deployment, even without owning those areas.

Nice To Haves

Experience through an acquisition or platform integration, aligning an acquired architecture with a parent platform.
Experience with integration-heavy platforms and their authentication and secrets challenges.
Familiarity with graph databases or immutable or event-sourced storage models.
Authored or shaped identity standards or RFCs.
Built or operated a production credential broker or identity provider.
BS/MS in Computer Science or a related field, or equivalent experience.

Responsibilities

Own the identity model for workloads and agents, including SPIFFE/SPIRE trust domains, workload attestation, and identity issuance, scoping, rotation, and revocation.
Architect end-to-end ephemeral authentication and authorization, including short-lived credential issuance, token exchange and delegation, and effective revocation.
Define runtime authorization for agents, including access, delegated authority, guardrails, and reviewable audit trails.
Lead identity architecture for the Agent Security roadmap, including Runtime Authorization, the Access Policy Engine, and AgentID with short-lived credentials, and integrate it with the NHI program.
Set identity standards for non-human identities across Veza integrations, including connector authentication, scoping, and secret rotation.
Define identity contracts for the graph, data model, and integrations architectures, and review designs in those areas for identity correctness.
Shape identity’s role in the Veza-ServiceNow integration model, including shared identity and data contracts and UI surfacing patterns.
Partner with integrations, graph, and deployment owners on decisions that touch identity without taking over their domains.
Represent Veza’s identity architecture to customers, partners, ServiceNow Security leadership, and standards bodies.
Mentor engineers.