Cybersecurity Engineer

Workday is hiring a Cybersecurity Engineer for its Security Automation & Integration Engineering team. The role builds and maintains agent scaffolds, evaluation systems, schemas, and user-facing applications on security data, helping security teams improve detection, response, and threat intelligence workflows.

Responsibilities

Own agent-adjacent application work: eval harnesses, agent scaffolds, and the UIs that security partners use to inspect and act on results

Design, build, and evolve schemas and data contracts so agents and humans share the same objects rather than one-off payloads

Take partner requests from vague to shipped: scope the problem, propose approaches, choose one, and drive it through design, review, rollout, and operational readiness (eval, tracing, runbooks)

Build and maintain integrations across security tools and enterprise platforms - SOAR, SIEM, vulnerability scanners, ticketing - when the application or agent needs them

Raise the team's AI-augmented engineering floor: shared skills, reusable scaffolds, a review discipline for AI-generated code, and eval that catches drift

Iterate quickly: prototype, test, ship, learn, improve - and bring the team with you

Preferred

Agent / eval** - LangChain, LangGraph, LangSmith, or similar; LLM-as-judge or offline eval; tracing and observability for agent runs

Application / UI** - frontend (React or similar) for internal tools; watchlist / dashboard / workflow UIs on security data

Security domain** - hands-on with security tools or data for triage and investigation (SIEM, vulnerability scanners, identity systems, orchestration platforms such as Tines); curiosity about detection-engineering workflows

Data / schema** - comfort reasoning about shared schemas or data contracts that span team boundaries, treating what / who / state as a first-class artifact

Cloud / platform familiarity** - working AWS fluency (enough to ship and operate); IaC (Terraform/Docker) is useful but not the daily job

Comfort operating in ambiguous problem spaces where you help define the solution, not just implement it

LangChain

LangGraph

LangSmith

Offline Evaluation

Agent Tracing

Frontend Development

React

Internal Tool Development

Dashboard UI Development

Security Data Workflows

Triage

SIEM

Vulnerability Scanners

Identity Systems

Security Orchestration Platforms

Tines

Detection Engineering

Shared Schema Design

Cross-Team Data Modeling

AWS

Cloud Operations

Infrastructure as Code

Terraform

Docker

Comfort With Ambiguity

Problem-Solving

Curiosity

Solution Definition

Benefits

This role may be eligible for the Workday Bonus Plan or a role-specific commission/bonus.

Annual refresh stock grants.

Flex Work: spend at least half (50%) of time each quarter in the office or in the field with customers, prospects, and partners (depending on role), with a flexible schedule.

Company

Enterprise AI platform for HR, finance, and IT management

Pleasanton, California, USA

http://www.workday.com/

Founded in 2005

10001+ employees

Qualifications

Strong Python skills with hands-on experience shipping production software (APIs, services, batch jobs, or application backends), including code review, testing, and operational follow-through

Hands-on experience building or evaluating LLM / agent systems (harnesses, eval, tracing, or agentic pipelines) *or* strong software-engineering fundamentals plus demonstrated AI-augmented development (Copilot, coding agents) with a point of view on where they help

Comfort designing or evolving schemas / data contracts and application UIs that sit on real data - not mock-only prototypes

Working knowledge of core cybersecurity practices - identity and access, secrets handling, secure-by-default configuration, and reasoning over common security data (vulnerabilities, incidents, identity, threat intel) - so you can build *for* security outcomes

Comfortable owning what you ship (runbooks, basic observability, eval that still runs after you merge)

Agent / eval** - LangChain, LangGraph, LangSmith, or similar; LLM-as-judge or offline eval; tracing and observability for agent runs

Application / UI** - frontend (React or similar) for internal tools; watchlist / dashboard / workflow UIs on security data

Security domain** - hands-on with security tools or data for triage and investigation (SIEM, vulnerability scanners, identity systems, orchestration platforms such as Tines); curiosity about detection-engineering workflows

Data / schema** - comfort reasoning about shared schemas or data contracts that span team boundaries, treating what / who / state as a first-class artifact

Cloud / platform familiarity** - working AWS fluency (enough to ship and operate); IaC (Terraform/Docker) is useful but not the daily job

Comfort operating in ambiguous problem spaces where you help define the solution, not just implement it

Required skills

Python, Production Software Engineering, LLM/Agent Systems, AI-Augmented Development, Schema Design, Data Contracts, Application UI Development, Cybersecurity Practices, Identity and Access Management, Secrets Handling, Security Data Analysis, LangChain, LangGraph, LangSmith, React, SIEM, Vulnerability Scanning, Tines, AWS, Terraform, Docker

Experience

Mid level