Principal Cloud IAM Engineer; US Federal

Our team focuses on delivering outcomes that serve U.S. federal agencies, modernizing the employee lifecycle experience and finance operations.

This role will support one or more direct or indirect contracts with the U.S. Federal Government. Due to federal security requirements, all Workday personnel working on the contracts must be U.S. citizens (naturalized or native). Employees may be required to work on site at client locations in the DC, MD, and VA area.

We are looking for a cloud engineer focused on managing entitlements and permissions in a cloud services environment (AWS, Azure/EntraID, or GCP). Responsibilities include automating identity administration, authentication, and authorization to resources in the air‑gapped network, using infrastructure as code, CI/CD pipelines, and IAM protocols such as OAUTH, OIDC, SAML, and SCIM.

Collaboration with other cloud engineering teams and the Cybersecurity organization is essential as we build a new organization focused on the unique requirements of DoD and Intel agencies.

• U.S. citizenship is required.
• May require a TS/SCI w/CI Poly clearance; active clearance is preferred.
• 8+ years as a cloud engineer, focused on IAM.
• Experience centralizing authentication/authorization and RBAC/PBAC.
• Managing infrastructure as code with tools like Git Hub and Terraform.
• Developing automation tools in Python or other programming languages.
• Integrating cloud platforms with external tools such as Okta, EntraID, or similar for SSO.
• Experience with SEIM tools (Splunk or similar) for log aggregation, threat playbooks, and auditing.
• Familiarity with NIST 800-53 and DoD/Intel control frameworks.
• Bachelor’s degree or higher in computer science, cybersecurity, or comparable experience.
• Familiarity with identity governance workflows and user lifecycle management (joiners, movers, leavers).

Base pay range (primary location, USA – VA – Reston): $191,500

USD – $287,300

USD. Additional U.S. location range: $173,300

USD – $309,600

USD. The role may be eligible for the Workday Bonus Plan, role‑specific commission/bonus, and annual refresh stock grants.

Flexible work combining in‑person and remote. You are expected to spend at least 50% of time per quarter in the office or with customers, prospects, or partners. Remote roles can attend office events as needed.

Workday is an Equal Opportunity Employer, including individuals with disabilities and protected veterans. We are committed to providing an accessible and inclusive hiring experience. Required accommodations can be requested via

Workday will not request payment or use non‑Workday sites for application. We do not accept resumes from headhunting agencies unless a formal agreement is signed.