Workday

Workday

Principal Active Defense Engineer

USA.VA.Reston · Principal

Sponsorship not specifiedDetected 4 days ago
JavaScriptPythonJavaKotlinScalaCode ReviewCI/CDMachine LearningSparkData AnalysisData EngineeringData ScienceLLMsAgentic AICybersecuritySIEMDetection EngineeringIncident ResponseHRISTest AutomationLeadershipCommunicationMentoringCISSP

Stay score

odds of building a lasting career here

42Risky
Cap-exempt (no lottery)0
Sponsors this role100
Entry-level history0
PERM / green-card track0
Lottery odds40
Fits your clock70

Thin sponsorship signal and lottery-bound. A low-probability bet with your clock running. Prioritize cap-exempt roles and proven entry-level sponsors first.

Lottery odds assume a STEM candidate.

Personalize to your clock →

Employer immigration record

from this employer's Department of Labor filings

Green-card filing pattern in this occupation

Context, not a finding about this posting: of this employer's 92 green-card filings in this occupation, 100% were for a worker who already held the job.

Green-card intent detected

Workday, Inc. obtained a prevailing wage determination for Software Developers in Boulder, COLORADO on 2026-06-15. No matching green-card filing appears in our data yet. The determination expires in 7 days (2026-09-12), and a green-card filing must follow before then or the employer starts over.+2 more active determinations on file

Green-card follow-through: 98%

Of 58 labor certifications old enough to have been used, 1 expired without the employer filing the next step. Median time from filing to decision: 497 days.100% of their filings were for a worker who already held the job.Only certifications past the 180-day window are counted — recent ones cannot have expired yet.

Files H-1B transfers

49 transfer filings in the last year, covering 49 workers. Median labor-condition decision: 7 days. An employer that already files transfers is one that can take over an existing H-1B.

Sourced from Department of Labor LCA, PERM and prevailing-wage disclosure data. Employer matching is by name, so figures may be split across an employer's legal entities. Absence of a filing means none appears in our copy of the data, not that none exists.

Community outcomes

No reports yet — be the first to help the next applicant.

About the role

  • This role is the senior technical anchor for Active Defense.
  • As a Principal Active Defense Engineer, you will set the technical direction for how Workday detects threats, and you will be the engineer the team looks to when a problem is ambiguous, spans several systems, or has no obvious owner.
  • Our work runs from translating threat intelligence into new detections, through the quality and fidelity of the alerts we hand to incident response, to the detections-as-code pipeline, curated datasets, and CI/CD tooling that all of it depends on.

Responsibilities

  • Set the technical direction. Own the architecture decisions, detection methodology, and design standards for the detection portfolio and the platform it runs on.
  • Be the review authority. Serve as the senior reviewer for infrastructure changes and complex detections, so that design and code review is a fast path for the team rather than a queue.
  • Lead large initiatives through to live operation. Take ambiguous problems from concept all the way to running in production, including the validation, documentation, and response playbook that make an alert worth acting on.
  • Build for reuse. Advance the detections-as-code lifecycle, CI/CD, validation tooling, and curated datasets, turning one-off solutions into patterns the whole team adopts.
  • Raise the technical ceiling of the team. Mentor engineers through design review, code review, and pull request feedback so that judgment and delivery scale beyond any one person.
  • Lead how we apply AI. Determine where agents, automation, and generative tooling belong in authoring, validating, and tuning detections, and where they do not.
  • Depth in detection engineering: 10+ years in software, platform, or security engineering, including significant time building and operating detection or security capabilities at production scale.
  • Technical leadership as an individual contributor: Experience setting technical direction, leading complex multi-system initiatives, and raising the level of the engineers around you through design and code review, without managing people.
  • Software development expertise: Experience in a general-purpose programming language such as Python, Java, Kotlin, Scala, or JavaScript, used to build detection logic, tooling, and automation.
  • Our approach enables our teams to deepen connections, maintain a strong community, and do their best work.

Requirements

  • Software development expertise:
  • Experience applying generative AI, conversational AI, or AI agents to security engineering work, including cases where you concluded the AI-assisted approach was the wrong one.
  • Experience with SIEM platforms such as Splunk, and with developing, securing, and monitoring applications in public cloud environments.
  • AI-assisted engineering judgment: Experience applying generative AI, conversational AI, or AI agents to security engineering work, including cases where you concluded the AI-assisted approach was the wrong one.
  • Platform and cloud breadth: Experience with SIEM platforms such as Splunk, and with developing, securing, and monitoring applications in public cloud environments.
  • Production engineering discipline: Experience with automated testing, validation, and deployment for detection content, not only version control.
  • We know that flexibility can take shape in many ways, so rather than a number of required days in-office each week, we simply spend at least half (50%) of our time each quarter in the office or in the field with our customers, prospects, and partners (depending on role).
  • Workday is committed to providing reasonable accommodations for qualified individuals during our application process, in order to perform one or more essential functions of their job, as well as regarding the use of AI tools for employment decision-making to any degree.
  • Relevant certifications or training such as SANS or CISSP are useful but not required.

Skills

  • Your work days are brighter here.

Compensation

  • $167,200 USD - $300,000 USD
  • In addition, Workday will never ask candidates to pay a recruiting fee, or pay for consulting or coaching services, in order to apply for a job at Workday.
  • Workday Pay Transparency Statement
  • The annualized base salary ranges for the primary location and any additional locations are listed below.

Benefits

  • Drive coverage, fidelity, and noise reduction so that the alerts reaching our incident responders are worth their attention.
  • Partner with incident response, threat intelligence, security tooling, audit, and platform teams, and serve as the expert voice on detection coverage and capability.
  • Our Approach to Flexible Work
  • This means you'll have the freedom to create a flexible schedule that caters to your business, team, and personal needs, while being intentional to make the most of time spent together.
  • Continuous learning:
  • Enthusiasm for emerging work in security, data science, and machine learning, with the judgment to know what is worth adopting.
  • Those in our remote "home office" roles also have the opportunity to come together in our offices for important moments that matter.

Company info

  • Our Active Defense team is a group of highly skilled and dedicated professionals who are passionate about protecting our organization from cyber threats.
  • We source, evaluate, and analyze both internal and external data, providing critical insight to a variety of security and business teams.
  • We use emerging and relevant intelligence to test our defenses rapidly.
  • We perform detailed analysis while meeting the challenge to scale to the business needs.
  • We are a core function of the overall Cyber Defense organization at Workday that helps keep the company and its customer data safe every day.
  • Our team members have a strong background in cybersecurity, data analysis, AI and machine learning, and detection engineering.
  • We use innovative tools and technologies to analyze and visualize data, including Splunk, Spark, Python, and AI-assisted analysis and automation tools.
  • We value teamwork and collaborate closely with other security teams to ensure that our organization stays ahead of emerging cyber threats.
  • We are committed to continuous learning and professional development, and regularly attend industry conferences and training sessions to stay up to date on the latest trends and best practices in security analytics.

Equal opportunity

  • Workday is an Equal Opportunity Employer including individuals with disabilities and protected veterans.
  • If you require a reasonable accommodation, you may email accommodations@workday.com, as far in advance as possible.
  • Please see below for more details including how to request an accommodation as a qualified veteran, due to a disability or for religious reasons, or as otherwise provided under applicable law.
Apply directly at Workday →Create a free account for alerts like thisView Workday immigration profile

This listing is sourced directly from Workday's careers page and normalized into a canonical job model.