Principal IAM Architect - Cloud Identity & Access

Workday; Reston (VA); Hybrid; USD 185,000 - 277,000; Full time

Job summary

Workday seeks a Principal engineer to own the strategy and architecture of its IAM program, setting patterns for engineers and guiding secure production for AI agents. This strategic, hands-on role influences identity across Workday.

You will partner with engineering, security, and Risk leadership to advance identity at scale, drive Zero Trust, and embed guardrails in CI/CD and Terraform.

Qualifications

• Own the multi-year IAM architecture and roadmap across human and non-human identity, cloud authorization, federation, and secrets management.
• Deep AWS IAM expertise: multi-account Organizations, SCPs, IAM Identity Center, ABAC, and secrets management (AWS Secrets Manager, HashiCorp Vault, or similar).
• Enterprise workforce identity experience with Okta or an equivalent platform (Entra ID, Ping, etc.), including SSO, MFA, SCIM, and lifecycle management.

Responsibilities

• Own the multi-year IAM architecture and roadmap across human and non-human identity, cloud authorization, federation, and secrets management.
• Design and evolve AWS identity at scale, including Organizations, SCPs, IAM Identity Center, ABAC, and least-privilege patterns across hundreds of accounts.
• Architect workforce identity: SSO, adaptive MFA, SCIM provisioning, and lifecycle automation.
• Define identity patterns for AI agents and service-to-service workloads, including how they authenticate, what they can assume, and how their actions are observed and governed.
• Drive Zero Trust in practice through identity-aware access, conditional policies, and workload-level controls.
• Embed identity guardrails into Terraform and CI/CD so secure is the default path.
• Partner with Risk and GRC to turn threat exposure into pragmatic decisions, and push back on controls that add friction without reducing risk.
• Mentor engineers and raise the IAM expertise of the broader team.

Skills

IAM architecture

AWS IAM

Okta/Entra ID

SAML/OIDC/OAuth2

Terraform

Mentoring

Tools

AWS Secrets Manager

HashiCorp Vault

Job description

Workday seeks a Principal engineer to own the strategy and architecture of its IAM program, setting patterns for engineers and guiding secure production for AI agents. This strategic, hands-on role influences identity across Workday.

You will partner with engineering, security, and Risk leadership to advance identity at scale, drive Zero Trust, and embed guardrails in CI/CD and Terraform.