Principal Software Engineer - Veza

Responsibilities

• Own the identity model for workloads and AI agents, including trust domains, workload attestation, identity issuance, scoping, rotation, and revocation.
• Architect ephemeral authentication and authorization, including short-lived credentials, token exchange, delegation, and effective revocation.
• Define runtime authorization for agents with delegated authority, guardrails, and reviewable audit trails.
• Lead identity architecture for the Agent Security roadmap, including Runtime Authorization, the Access Policy Engine, AgentID, and integration with the NHI program.
• Set identity standards for non-human identities across integrations, including connector authentication, secret scoping, and rotation.
• Define identity contracts for graph, data model, and integrations architects and review related designs for identity correctness.
• Shape identity integration with the Veza-ServiceNow platform, including shared identity and data contracts and UI surfacing patterns.
• Partner with integrations, graph, and deployment owners on cross-domain architecture decisions.
• Represent Veza’s identity architecture to customers, partners, ServiceNow Security leadership, and standards bodies.
• Mentor engineers and deliver a published identity architecture, adopted ephemeral credential model, runtime authorization design, and cross-team identity contracts within the first 12 months.

Requirements

• 12+ years of experience in security or identity engineering, with substantial production-scale identity systems design experience.
• Strong background in identity and access domains such as IGA, IAM, PAM, authorization models, access reviews, and lifecycle management.
• Deep hands-on expertise in workload identity, specifically SPIFFE/SPIRE or an equivalent, and ephemeral credential design.
• Strong grounding in OAuth 2.x, OIDC, token exchange, RBAC, ABAC, ReBAC, and policy engines such as OPA or Cedar.
• Understanding of non-human identities, including service accounts, secrets, API keys, workload identity, and emerging agent identity models.
• Experience building security products meeting security and compliance requirements such as SOC 2, FedRAMP, or equivalent, including data residency considerations.
• Experience delivering production AI or agentic systems with evaluation, guardrails, and human-in-the-loop controls.
• Active use of AI-native development tools such as Claude Code, Cursor, Codex, or equivalent.
• Strong Python or Go skills and ability to contribute deeply to code and design reviews.
• Executive-level communication skills and ability to defend identity decisions to engineers, customers, and security leadership.
• Breadth across graph data models, integration architecture, and multi-region deployment.
• Preferred: acquisition or platform integration experience, integration-heavy platform experience, graph databases or immutable/event-sourced storage familiarity, authorship or shaping of identity standards or RFCs, and experience building or operating a credential broker or identity provider.
• BS/MS in Computer Science or a related field, or equivalent experience.

Benefits

• Base pay of $199,100-$348,400, plus equity when applicable, variable/incentive compensation, and benefits.
• Health plans including flexible spending accounts, a 401(k) plan with company match, ESPP, matching donations, flexible time away, and family leave programs.
• Flexible distributed work persona, with eligibility categorized as flexible, remote, or required in office based on role and location.
• Regular employee position in the North America and Canada region.