Senior Cybersecurity Engineer - Enterprise Security Engineering

Workday • Atlanta, GA

1d • Hybrid

About The Position

The Senior Cybersecurity Engineer on Workday’s Enterprise Security Engineering team bridges strategic architecture and operational delivery. The role owns detection telemetry, SaaS configuration drift, and asset-control gap verification, and provides escalation support and technical guidance to associate and mid-level engineers.

The team protects Workday’s global corporate environment across endpoint infrastructure, developer enablement, and security automation. Its work includes endpoint privilege management, endpoint detection and response (EDR), SaaS security posture management (SSPM), and governance of developer tools and emerging AI technologies. The team is expanding agentic automation pipelines, evolving application control frameworks for safe AI adoption, and integrating endpoint, SaaS posture, and threat detection systems.

This position is based on Workday’s flexible-work approach: employees spend at least half of their time each quarter in the office or in the field, with flexibility to arrange schedules around business, team, and personal needs. Remote home-office employees may also come together in offices for important occasions.

Requirements

• At least 7 years of hands-on cybersecurity engineering experience in enterprise environments, with demonstrated success operating at a senior technical level.
• Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, or a related discipline.
• At least one recognized credential, such as CISSP, a GIAC certification (for example GSEC, GCED, GCIA, GCIH, or GDSA), CompTIA Security+, or an equivalent vendor-recognized credential.
• Hands-on experience engineering, administering, or deploying enterprise tooling in at least two of these domains: EDR, SSPM, CAASM, or EPM/application control.
• Working knowledge of macOS and Windows internals and execution controls.
• Enterprise scripting proficiency in Python, PowerShell, Bash, or Go, with REST API experience.
• Clear written and verbal communication skills, including the ability to translate complex security telemetry into actionable guidance for cross-functional partners.
• Ability to manage multiple projects and priorities while maintaining operational responsibilities.

Nice To Haves

• Experience in attack-surface analysis, including understanding system architecture, identifying potential entry points, and assessing threats to reduce organizational vulnerability.
• Experience designing and implementing security systems, protocols, and procedures that protect information and data from unauthorized access or damage.
• Experience conducting security audits and developing incident-response plans.
• Proficiency configuring, operating, and managing enterprise security software, hardware, and services.
• Familiarity with current cybersecurity defense strategies and their operational application.
• Knowledge of threat and vulnerability management, including identifying, assessing, and mitigating risks and weaknesses in security infrastructure.
• Experience conducting vulnerability assessments and staying current with the evolving threat landscape.
• Experience in security operations, including identifying, analyzing, and mitigating threats to enterprise information assets.
• Comfort developing and implementing security policies, managing security incidents, and guiding teams on best practices.
• Proficiency in one or more programming languages for designing, writing, testing, and debugging code for automation, process improvement, and API integration across security tooling.
• Genuine interest in mentoring and developing fellow engineers.

Responsibilities

• Partner with Principal engineers on endpoint least-privilege policies, publisher allow-listing controls, and application governance workflows across macOS and Windows fleets.
• Escalate and resolve complex application-definition triage and advanced exception reviews.
• Provide engineering oversight, sensor-health monitoring, and detection tuning across the enterprise EDR estate.
• Build and maintain automated detection and containment workflows, partnering with internal teams to triage complex endpoint telemetry.
• Support operational posture and policy configuration baselines across the SSPM environment.
• Identify, investigate, and remediate SaaS configuration drift, privileged-account anomalies, and integration risks across critical enterprise SaaS services.
• Drive asset governance, device-coverage validation, and security-control gap identification through CAASM.
• Build queries, automated dashboards, and correlation alerts to ensure agent coverage and policy compliance across corporate assets.
• Implement and maintain runtime guardrails and least-privilege boundaries for developer AI tools, coding assistants, and open-source dependencies.
• Partner with architecture leads to monitor and evaluate security posture of AI agents and IDE integrations across developer endpoints.
• Use agentic evaluation pipelines and automation workflows to streamline intake triage, exception processing, and routine telemetry reviews.
• Build API-driven integrations that feed endpoint, SaaS posture, and asset signals into central automation and threat-containment pipelines.
• Collaborate with and mentor associate and mid-level engineers, sharing best practices in script automation, detection engineering, and incident triage.
• Write technical runbooks, architecture diagrams, and operational playbooks to improve team delivery standards.

Benefits

• The role may be eligible for the Workday Bonus Plan or a role-specific commission/bonus.
• Annual refresh stock grants may be awarded by Workday Inc.
• Flexible work scheduling under Workday’s Flex Work approach.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior