Engineering Manager - Workload Identity & Secrets Platform

Job Description

Job Description

Procore runs thousands of services across multiple production regions, and too many of them still authenticate with static, long-lived credentials. We're replacing that model with a Vault-backed identity platform where credentials are short-lived, issued on demand, and tied to workload identity — not to a secret someone pasted into a config file three years ago.

We're hiring an Engineering Manager to lead the team that owns that platform. You'll manage a focused team of 4–6 engineers, including senior and staff ICs already deep in this domain, and own the roadmap for how every engineer at Procore gets, rotates, and retires a credential.

To be straightforward about the shape of the job: this is a small, senior team, so you'll be partnering closely with your engineers on the ground. Success in this role requires a balance of strong team leadership and technical credibility. You won't be the primary implementer — your staff engineers own the designs and write the code — but rather than managing purely from a distance, you’ll be actively engaged in architectural decisions, making defensible build-vs-buy calls, and building deep system context to help the team navigate tradeoffs and tackle complex, specialized work together.

This position reports to a Senior Manager within the Developer Acceleration group and will be based in our Austin,TX office.   We're looking for someone to join us immediately.

What you'll do:

• The migration off static credentials. Driving adoption of dynamic, identity-based credentials across Procore's service estate — not just building the platform, but getting teams to move onto it.

• Developer experience for secrets. Self-service provisioning, credential lifecycle, certificate rotation, and the standards that make the secure path the easy path.

• The team. Hiring, growing, and retaining engineers across US and international time zones, including career development for senior and staff ICs in a narrow specialty.

• Reliability of a Tier-0 dependency. When the secrets platform degrades, deploys stop. SLOs, on-call health, and incident response are yours.

• Partnership with Security Engineering. Aligning platform investment against real compliance and audit obligations without turning your team into a ticket queue.

• Prioritization under ambiguity. This domain generates far more demand than a six-person team can absorb. Deciding what not to do is a core part of the job.

What we're looking for:

• 2+ years managing software or infrastructure engineering teams, including senior or staff ICs

• 7+ years total engineering experience, with hands-on background in backend systems, distributed infrastructure, or platform engineering

• Direct experience with secrets management or identity infrastructure — Vault or equivalent, OIDC, PKI, certificate lifecycle, least-privilege access models

Complementary — genuinely not required

• External Secrets Operator, SPIFFE/SPIRE, or workload identity federation

• Experience in a regulated or audited environment (SOC 2, ISO 27001, FedRAMP)

• Vendor evaluation and contract negotiation for infrastructure tooling

• Working fluency in Kubernetes and infrastructure-as-code (Terraform/HCL, Helm)

• A track record of building internal platforms other engineers actually adopted, plus the influence to drive migrations across teams you don't control

• Comfort operating a service other teams depend on: SLOs, incident management, on-call

Additional Information

Base Pay Range:

168,560.00 - 231,770.00 USD Annual

This role may also be eligible for Equity Compensation and/or Bonus Incentive Compensation. Procore is committed to offering competitive, fair, and commensurate compensation. Actual compensation will be based on a candidate’s job-related skills, experience, education or training, and location.

This position requires access to technology, software, and data that is controlled or restricted under U.S. law, regulation, executive order, or government contract.

For Los Angeles County (unincorporated) Candidates:

Procore will consider for employment all qualified applicants, including those with arrest or conviction records, in accordance with the requirements of applicable federal, state, and local laws, including the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act.

A criminal history may have a direct, adverse, and negative relationship on the following job duties, potentially resulting in the withdrawal of the conditional offer of employment: 1. appropriately managing, accessing, and handling confidential information including proprietary and trade secret information, as well as accessing Procore's information technology systems and platforms; 2. interacting with and occasionally having unsupervised contact with internal/external customers, stakeholders, and/or colleagues; and 3. exercising sound judgment.