Principal Software Engineer - Veza

What you'll do Identity • Own the identity model for workloads and agents: SPIFFE/SPIRE trust domains, workload attestation, and how identities are issued, scoped, rotated, and revoked. • Architect ephemeral authentication and authorization end to end: short-lived credential issuance, token exchange and delegation (for example RFC 8693-style flows), and revocation that takes effect in practice. • Define runtime authorization for agents: what an agent can access, under whose delegated authority, with what guardrails, and with audit trails that hold up to review. • Lead the identity architecture for the Agent Security roadmap, including Runtime Authorization, the Access Policy Engine, and AgentID with short-lived credentials, and its integration with the NHI program. • Set the identity standards for non-human identities across Veza’s integrations, covering how connectors authenticate, get scoped, and rotate secrets. Core architecture • Define identity contracts that the graph, data model, and integrations architects build against, and review designs in those areas for identity correctness. • Shape how identity fits into the Veza-ServiceNow integration model, including shared identity and data contracts and UI surfacing patterns. • Partner with the integrations, graph, and deployment owners on decisions that touch identity, without taking over their domains. Leadership • Represent Veza’s identity architecture to customers, partners, ServiceNow Security leadership, and standards bodies. • Mentor engineers What you bring • 12+ years in security or identity engineering, with a substantial share spent designing identity systems in production at scale. • Strong background in identity and access: IGA, IAM, PAM, authorization models, access reviews, lifecycle management, or adjacent security domains. • Deep hands-on expertise in workload identity, specifically SPIFFE/SPIRE or an equivalent, and in ephemeral credential design. You can explain trust bootstrapping and rotation failure modes without notes. • Strong grounding in OAuth 2.x, OIDC, token exchange, and authorization models (RBAC, ABAC, ReBAC, and policy engines such as OPA or Cedar). • Understanding of non-human identity (service accounts, secrets, API keys, workload identity) and emerging agent identity and authorization models. • Experience building security products that meet their own security and compliance bar (SOC 2, FedRAMP or equivalent, data residency). • Experience delivering production AI or agentic systems, including evaluation, guardrails, and human-in-the-loop controls. • Active use of AI-native development tools (Claude Code, Cursor, Codex, or equivalent). • Strong Python or Go, with the ability to go deep in code and design reviews. • Executive-level communication, with the ability to defend an identity decision to engineers, customers, and security leadership. • Breadth to hold your own on graph data models, integration architecture, and multi-region deployment, even if you don’t own them.   Preferred • Experience through an acquisition or platform integration, aligning an acquired architecture with a parent platform. • Experience with integration-heavy platforms and the authentication and secrets challenges they bring. • Familiarity with graph databases or immutable or event-sourced storage models. • Authored or shaped identity standards or RFCs. • Built or operated a production credential broker or identity provider. • BS/MS in Computer Science or a related field, or equivalent experience. Success in the first 12 months • A published identity architecture for workload and agent access, with committed milestones. • A defined, adopted model for ephemeral credentials across Veza’s services and integrations. • A runtime authorizati