Senior IAM Architect for Zero-Trust Cloud Security (AWS)

HR Tech Job; Reston (VA); Hybrid; USD 185,000 - 300,000; Full time

Job summary

Workday's Identity is the cornerstone of our security posture, protecting data for millions of users and thousands of enterprises. We seek a Principal IAM Engineer to own the strategy and architecture of our IAM program, setting patterns for engineers and guiding secure AI agent production. This is a strategic, hands-on role vs.

operations, with influence across security, risk, and engineering leadership. You'll partner with Security and Risk leadership, defining scalable identity controls,

Qualifications

• 0+ years in cloud security or IAM, including 3+ years in staff, or architect role owning technical direction.
• Deep AWS IAM expertise: multi-account Organizations, SCPs, IAM Identity Center, ABAC, and secrets management.
• Enterprise workforce identity experience with Okta or an equivalent platform (Entra ID, Ping, etc.), including SSO, MFA, SCIM, and lifecycle management.
• Strong working knowledge of SAML, OIDC, and OAuth2, including debugging them in complex environments.
• Terraform fluency and an understanding of how identity controls are enforced through CI/CD.
• A track record of driving alignment across engineering, security, and business teams without positional authority.

Responsibilities

• Own the multi-year IAM architecture and roadmap across human and non-human identity, cloud authorization, federation, and secrets management.
• Design and evolve AWS identity at scale, including Organizations, SCPs, IAM Identity Center, ABAC, and least‑privilege patterns across hundreds of accounts.
• Architect workforce identity: SSO, adaptive MFA, SCIM provisioning, and lifecycle automation.
• Define identity patterns for AI agents and service‑to‑service workloads, including how they authenticate, what they can assume, and how their actions are observed and governed.
• Drive Zero Trust in practice through identity‑aware access, conditional policies, and workload‑level controls.
• Embed identity guardrails into Terraform and CI/CD so secure is the default path.
• Partner with Risk and GRC to turn threat exposure into pragmatic decisions, and push back on controls that add friction without reducing risk.
• Mentor engineers and raise the IAM expertise of the broader team.

Skills

AWS IAM

SAML/OIDC/OAuth2

Okta/Entra ID

Terraform

CI/CD security

Cross-team collaboration

Tools

HashiCorp Vault

AWS Secrets Manager

Job description

Workday's Identity is the cornerstone of our security posture, protecting data for millions of users and thousands of enterprises. We seek a Principal IAM Engineer to own the strategy and architecture of our IAM program, setting patterns for engineers and guiding secure AI agent production. This is a strategic, hands-on role vs.

operations, with influence across security, risk, and engineering leadership. You'll partner with Security and Risk leadership, defining scalable identity controls,