Senior Cybersecurity Engineer - Enterprise Security Engineering

Workday•Atlanta, GA

2d•€84,000 - €126,000•Hybrid

About The Position

The Senior Cybersecurity Engineer joins Workday’s Enterprise Security Engineering team, which protects the company’s global corporate environment while enabling engineering teams to build and ship securely. The role bridges strategic architecture and operational delivery, taking ownership of detection telemetry, SaaS configuration drift, and asset-control gap verification. It also provides high-touch escalation support and technical guidance to associate and mid-level engineers. The engineer supports endpoint least-privilege and application governance across macOS and Windows, develops and tunes enterprise EDR monitoring and automated response, and helps maintain SSPM policies and configuration baselines. The position also drives asset governance and coverage validation through CAASM, implements runtime safeguards for developer AI tools and dependencies, and builds automation and API integrations connecting endpoint, SaaS, and asset signals to security response workflows. The role includes mentoring colleagues and producing technical documentation and operational playbooks.

Requirements

At least 7 years of hands-on cybersecurity engineering experience in enterprise environments, with demonstrated success operating at a senior technical level.
Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, or a related discipline.
At least one recognized credential, such as CISSP, a GIAC certification (e.g., GSEC, GCED, GCIA, GCIH, or GDSA), CompTIA Security+, or an equivalent vendor-recognized credential.
Hands-on experience engineering, administering, or deploying enterprise tooling in at least two of these domains: EDR, SSPM, CAASM, or EPM/Application Control.
Working knowledge of macOS and Windows operating system internals and execution controls.
Enterprise scripting proficiency in Python, PowerShell, Bash, or Go, with REST API experience.
Clear written and verbal communication skills and the ability to translate complex security telemetry into actionable guidance for cross-functional partners.
Ability to manage multiple projects and priorities while maintaining operational responsibilities.

Nice To Haves

Experience in attack surface analysis, understanding system architecture, identifying potential entry points, and assessing threats to reduce organizational vulnerability.
Experience designing and implementing security systems, protocols, and procedures; security audits and incident response planning are valued.
Proficiency configuring, operating, and managing enterprise security platforms, and familiarity with current cybersecurity defense strategies and their operational application.
Knowledge of threat and vulnerability management, including vulnerability assessments, risk mitigation, and staying current with the evolving threat landscape.
Experience in security operations, including identifying, analyzing, and mitigating threats; developing security policies; managing incidents; and guiding teams on best practices.
Proficiency in one or more programming languages for writing, testing, and debugging automation, process-improvement, and API-integration code.
Genuine interest in mentoring and developing fellow engineers.

Responsibilities

Partner with Principal engineers on endpoint least-privilege policies, publisher allow-listing, and application governance across macOS and Windows fleets; handle complex application definition triage and advanced exception reviews.
Oversee engineering, sensor health monitoring, and detection tuning across the enterprise EDR estate.
Build and maintain automated detection and containment response workflows, partnering with internal teams to triage complex endpoint telemetry.
Support operational posture and policy configuration baselines in the SSPM environment.
Identify, investigate, and remediate SaaS configuration drift, privileged account anomalies, and integration risks across critical enterprise SaaS services.
Drive asset governance, device coverage validation, and security-control gap identification through CAASM.
Build queries, automated dashboards, and correlation alerts to ensure corporate assets have full agent coverage and policy compliance.
Implement and maintain runtime guardrails and least-privilege boundaries for developer AI tools, coding assistants, and open-source dependencies.
Partner with architecture leads to monitor and evaluate the security posture of AI agents and IDE integrations across developer endpoints.
Use agentic evaluation pipelines and automation workflows to streamline intake triage, exception processing, and routine telemetry reviews.
Build API-driven integrations that feed endpoint, SaaS posture, and asset signals into central automation and threat-containment pipelines.
Collaborate with and mentor associate and mid-level engineers on script automation, detection engineering, and incident triage.
Author technical runbooks, architecture diagrams, and operational playbooks to improve team delivery standards.