Sr Principal, GRC

Workday; United States; On-site; USD 190,000 - 270,000; Full time

Job summary

Workday is seeking a technical cybersecurity leader to drive enterprise-wide cybersecurity programs from concept to successful implementation. You will operate in a matrixed environment, architect transformational C&T initiatives, and design scalable security solutions and governance frameworks across the organization.

You will guide policy design, IaC practices, and automation to ensure secure adoption and measurable outcomes.

Qualifications

• 12+ years experience as a GRC or business leader, driving governance improvements.
• 10+ years in GRC domains, regulatory landscapes and GRC technologies.
• Bachelor's degree in a relevant discipline; Master's degree preferred or equivalent.

Responsibilities

• Lead enterprise-wide cybersecurity programs in a matrixed organization.
• Architect strategic C&T transformational programs with senior leadership.
• Drive policy-as-code and secure IaC adoption at scale.
• Develop AI-first operational transformation and governance.
• Engage cross-functionally to align Workday's cybersecurity positioning on AI topics.

Skills

GRC leadership

GRC domain experience

Regulatory awareness

Education

Bachelor's degree in Business Administration, Law, Finance, Information Security, or related; Master's preferred

Job description

Your work days are brighter here.

We're obsessed with making hard work pay off, for our people, our customers, and the world around us. As a Fortune 500 company and a leading AI platform for managing people, money, and agents, we're shaping the future of work so teams can reach their potential and focus on what matters most. The minute you join, you'll feel it. Not just in the products we build, but in how we show up for each other. Our culture is rooted in integrity, empathy, and shared enthusiasm. We're in this together, tackling big challenges with bold ideas and genuine care. We look for curious minds and courageous collaborators who bring sun-drenched optimism and drive. Whether you're building smarter solutions, supporting customers, or creating a space where everyone belongs, you'll do meaningful work with Workmates who've got your back. In return, we'll give you the trust to take risks, the tools to grow, the skills to develop and the support of a company invested in you for the long haul. So, if you want to inspire a brighter work day for everyone, including yourself, you've found a match in Workday, and we hope to be a match for you too.

About the Team

Workday Cybersecurity Governance, Risk, Compliance & Trust team builds and sustains trust in Workday's cybersecurity commitments by embedding a cybersecurity-first mindset, delivering cybersecurity assurance and enabling business growth. We act as trusted advisors and change agents across Workday to protect the data of our fellow Workmates and 8000+ customers.

About the Role

We are seeking a technical cybersecurity leader with a proven track record delivering large cross-functional programs from concept to success. You will need to be comfortable leading in a matrixed organization to drive enterprise-wide cybersecurity programs including, but not limited to, the cybersecurity communications program. Additionally, you will be the architect for strategic C&T transformational programs, working with the C&T leadership team, providing strategic leadership, driving process design and transformation, and architecting the development of internal automation and cybersecurity solutions to ensure successful adoption and overall effectiveness of organizational scale and achievement of strategic objectives.

Responsibilities:

• AI-First Operational Transformation
• Operational Engineering Evolution: Develop and implement the people, process, and technology transformations required to transition functional operations into continuous, data-driven, AI-first engineering programs, including architecting for security data integration and Agentic AI orchestration.
• Process & Technology Transformation: Refine existing workflows to eliminate bottlenecks, optimize cybersecurity tooling, and ensure the team is focused on high-value risk mitigation, including industrializing security governance and control enforcement by driving the adoption of policy-as-code and secure Infrastructure as Code (IaC) practices at scale.
• Talent Upskilling: Foster a deep cybersecurity mindset and drive talent upskilling initiatives across the organization to support program adoption.
• Advanced Metrics: Institute Key Performance Indicators (KPIs) and automated dashboards that measure the effectiveness of our processes, organizational adoption, and the achievement of strategic objectives.
• AI Security Customer Engagement
• Work cross-functionally (including but not limited to Legal, GCO, Product, Platform, and Cybersecurity) to design processes and enable tools to drive consistency in Workday's position and response to AI-related prospect and customer questions.
• Working with security risk, Legal, GCO and industry as well as regulatory partners, identify AI-cybersecurity topics that require positioning statements and drive efforts to secure investment, design and deliver solutions that mitigate evolving AI-security risks. Translate efforts into external facing communications that can be leveraged in the market.
• Govern talk tracks and supporting materials that reflect the current Workday's positioning on cybersecurity AI topics. Enable Chief Security Advisors and other Workday AI representatives to represent emerging cybersecurity AI topics with clarity and confidence.
• Operate as a representative of the executive cybersecurity voice - engaging with customers, prospects and industry groups to deliver thought leadership and security knowledge that bolsters Workday's security brand.

About You

Basic Qualifications

• Minimum of 12 years experience as a GRC or business leader, conceiving and implementing innovative GRC strategies, driving improvements in risk management and compliance effectiveness, and influencing overall organizational governance.
• Minimum of 10+ experience in GRC domains, regulatory landscapes and GRC technologies.
• Bachelor's degree in a relevant discipline such as Business Administration, Law, Finance, Information Security, or a related discipline; a Master's degree preferred or equivalent