SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 199,100 - 348,400 / annual
Veza, part of ServiceNow's Security & Risk organization, is building the identity security platform for human, non-human, and AI agent access. This Principal Software Engineer role focuses on architecting identity systems at the core of Veza's platform as it scales to handle autonomous agents operating at machine speed.
You will own the identity model for workloads and agents, including SPIFFE/SPIRE trust domains, workload attestation, and the full lifecycle of identity issuance, scoping, rotation, and revocation. You'll architect ephemeral authentication and authorization end-to-end: short-lived credential issuance, token exchange and delegation (RFC 8693-style flows), and revocation that takes effect in practice. You'll define runtime authorization for agents—what they can access, under whose delegated authority, with what guardrails, and with audit trails that hold up to review.
You'll lead the identity architecture for the Agent Security roadmap, including Runtime Authorization, the Access Policy Engine, and AgentID with short-lived credentials, and its integration with the NHI program. You'll set identity standards for non-human identities across Veza's integrations, covering how connectors authenticate, get scoped, and rotate secrets.
On core architecture, you'll define identity contracts that the graph, data model, and integrations architects build against, and review designs in those areas for identity correctness. You'll shape how identity fits into the Veza-ServiceNow integration model, including shared identity and data contracts and UI surfacing patterns. You'll partner with integrations, graph, and deployment owners on decisions that touch identity without taking over their domains.
You'll represent Veza's identity architecture to customers, partners, ServiceNow Security leadership, and standards bodies. You'll mentor engineers and help establish identity as a first-class concern across the platform.
In your first 12 months, you'll publish an identity architecture for workload and agent access with committed milestones, define an adopted model for ephemeral credentials across Veza's services and integrations, deliver a runtime authorization design for agents that Product and Sales can take to customers, and establish identity contracts agreed with the graph, integrations, and deployment owners.
REQUIREMENTS:
- 12+ years in security or identity engineering, with substantial time designing identity systems in production at scale
- Strong background in identity and access: IGA, IAM, PAM, authorization models, access reviews, lifecycle management, or adjacent security domains
- Deep hands-on expertise in workload identity, specifically SPIFFE/SPIRE or equivalent; can explain trust bootstrapping and rotation failure modes without notes
- Strong grounding in OAuth 2.x, OIDC, token exchange, and authorization models (RBAC, ABAC, ReBAC, policy engines such as OPA or Cedar)
- Understanding of non-human identity (service accounts, secrets, API keys, workload identity) and emerging agent identity and authorization models
- Experience building security products that meet their own security and compliance bar (SOC 2, FedRAMP or equivalent, data residency)
- Experience delivering production AI or agentic systems, including evaluation, guardrails, and human-in-the-loop controls
- Active use of AI-native development tools (Claude Code, Cursor, Codex, or equivalent)
- Strong Python or Go, with ability to go deep in code and design reviews
- Executive-level communication; ability to defend identity decisions to engineers, customers, and security leadership
- Breadth to hold your own on graph data models, integration architecture, and multi-region deployment
PREFERRED:
- Experience through an acquisition or platform integration, aligning acquired architecture with parent platform
- Experience with integration-heavy platforms and their authentication and secrets challenges
- Familiarity with graph databases or immutable or event-sourced storage models
- Authored or shaped identity standards or RFCs
- Built or operated a production credential broker or identity provider
- BS/MS in Computer Science or related field, or equivalent experience
