Principal Software Engineer - Veza

Description

The company needs a principal engineer to set identity architecture for workloads and AI agents, and to lead the identity side of its agent security work, its partner platform integration, and its non-human identity practices.

Within your first 12 months, you should deliver a published identity architecture for workload and agent access with committed milestones, a defined and adopted ephemeral credential model across the company's services and integrations, a runtime authorization design for agents that Product and Sales can present to customers, and identity contracts agreed with the graph, integrations, and deployment owners.

You will also represent the company's identity architecture externally and mentor engineers.

Responsibilities

• Design the identity model for workloads and agents, covering SPIFFE/SPIRE trust domains, workload attestation, and how identities are issued, scoped, rotated, and revoked.
• Design short-lived authentication and authorization across the stack, including short-lived credential issuance, token exchange and delegation such as RFC 8693-style flows, and revocation that works in real operation.
• Define how agents receive runtime authorization: which resources each agent can reach, whose delegated authority applies, which guardrails apply, and audit trails that hold up under review.
• Lead identity architecture for the agent security roadmap, covering runtime authorization, the access policy engine, agent ID with short-lived credentials, and how it connects to the NHI program.
• Set identity standards for non-human identities across the company's integrations, including how connectors authenticate, how they are scoped, and how their secrets rotate.
• Write identity contracts that the graph, data model, and integration architects build against, and review their designs for identity correctness.
• Shape how identity fits the integration with the partner platform, including shared identity and data contracts and how identity appears in the user interface.
• Work with the integrations, graph, and deployment owners on identity-related decisions without taking over their areas.
• Present the company's identity architecture to customers, partners, the partner's security leadership, and standards bodies.
• Mentor engineers.

Requirements

• More than 12 years in security or identity engineering, much of it spent designing identity systems in production at scale.
• Solid background in identity and access work such as IGA, IAM, PAM, authorization models, access reviews, lifecycle management, or nearby security areas.
• Hands-on depth in workload identity, specifically SPIFFE/SPIRE or an equivalent, and in ephemeral credential design. You can explain trust bootstrapping and rotation failure modes without notes.
• Strong knowledge of OAuth 2.x, OIDC, token exchange, and authorization models including RBAC, ABAC, ReBAC, and policy engines such as OPA or Cedar.
• Understanding of non-human identities (service accounts, secrets, API keys, workload identity) and of emerging agent identity and authorization models.
• Experience building security products that meet their own security and compliance bar, such as SOC 2, FedRAMP or an equivalent, and data residency requirements.
• Experience delivering production AI or agentic systems, including evaluation, guardrails, and human-in-the-loop controls.
• Regular use of AI-native development tools such as Claude Code, Cursor, Codex, or equivalent.
• Strong Python or Go, and the ability to go deep in code and design reviews.
• Executive-level communication, with the ability to defend an identity decision to engineers, customers, and security leaders.
• Enough breadth to hold your own on graph data models, integration architecture, and multi-region deployment, even if you do not own them.
• Preferred: experience through an acquisition or platform integration, aligning an acquired architecture with a parent platform.
• Preferred: experience with integration-heavy platforms and the authentication and secrets challenges they bring.
• Preferred: familiarity with graph databases or immutable or event-sourced storage models.
• Preferred: having authored or shaped identity standards or RFCs.
• Preferred: having built or operated a production credential broker or identity provider.
• Preferred: a BS or MS in Computer Science or a related field, or equivalent experience.

Conditions

Base pay for this location is $199,100 - $348,400, plus equity when applicable, variable or incentive compensation, and benefits.

The base pay shown is a guideline. Individual total compensation varies with qualifications, skill level, competencies, and work location.

Pay is based on the geographic location of the role and may change with work location.

Sales positions generally include an On Target Earnings incentive structure.

Work personas (flexible, remote, or required in office) are assigned based on the nature of the work and the assigned work location. Eligibility may be checked by measuring the distance between your primary residence and the nearest office with a third-party service.

Benefits

• Health plans, including flexible spending accounts.
• 401(k) plan with company match.
• Employee stock purchase plan (ESPP).
• Matching donations.
• Flexible time away plan and family leave programs.