Principal Software Engineer - Veza

What you'll do

Identity Own the identity model for workloads and agents: SPIFFE/SPIRE trust domains, workload attestation, and how identities are issued, scoped, rotated, and revoked. Architect ephemeral authentication and authorization end to end: short-lived credential issuance, token exchange and delegation (for example RFC 8693-style flows), and revocation that takes effect in practice.

Define runtime authorization for agents: what an agent can access, under whose delegated authority, with what guardrails, and with audit trails that hold up to review. Lead the identity architecture for the Agent Security roadmap, including Runtime Authorization, the Access Policy Engine, and AgentID with short-lived credentials, and its integration with the NHI program.

Set the identity standards for non-human identities across Veza's integrations, covering how connectors authenticate, get scoped, and rotate secrets. Core architecture Define identity contracts that the graph, data model, and integrations architects build against, and review designs in those areas for identity correctness.

• Shape how identity fits into the Veza-ServiceNow integration model, including shared identity and data contracts and UI surfacing patterns.
• Partner with the integrations, graph, and deployment owners on decisions that touch identity, without taking over their domains.
• Leadership Represent Veza's identity architecture to customers, partners, ServiceNow Security leadership, and standards bodies.
• Mentor engineers

Pay and benefits

What you bring 12+ years in security or identity engineering, with a substantial share spent designing identity systems in production at scale. Strong background in identity and access: IGA, IAM, PAM, authorization models, access reviews, lifecycle management, or adjacent security domains. Deep hands-on expertise in workload identity, specifically SPIFFE/SPIRE or an equivalent, and in ephemeral credential design.

You can explain trust bootstrapping and rotation failure modes without notes. Strong grounding in OAuth 2.x, OIDC, token exchange, and authorization models (RBAC, ABAC, ReBAC, and policy engines such as OPA or Cedar). Understanding of non-human identity (service accounts, secrets, API keys, workload identity) and emerging agent identity and authorization models.

Experience building security products that meet their own security and compliance bar (SOC 2, FedRAMP or equivalent, data residency). Experience delivering production AI or agentic systems, including evaluation, guardrails, and human-in-the-loop controls. Active use of AI-native development tools (Claude Code, Cursor, Codex, or equivalent). Strong Python or Go, with the ability to go deep in code and design reviews.

Executive-level communication, with the ability to defend an identity decision to engineers, customers, and security leadership. Breadth to hold your own on graph data models, integration architecture, and multi-region deployment, even if you don't own them. Preferred Experience through an acquisition or platform integration, aligning an acquired architecture with a parent platform.

Experience with integration-heavy platforms and the authentication and secrets challenges they bring. Familiarity with graph databases or immutable or event-sourced storage models. Authored or shaped identity standards or RFCs. Built or operated a production credential broker or identity provider. BS/MS in Computer Science or a related field, or equivalent experience.

Success in the first 12 months A published identity architecture for workload and agent access, with committed milestones. A defined, adopted model for ephemeral credentials across Veza's services and integrations. A runtime authorization design for agents that Product and Sales can take to customers. Identity contracts agreed with the graph, integrations, and deployment owners.

For positions in this location, we offer a base pay of $199,100 - $348,400, plus equity (when applicable), variable/incentive compensation and benefits. Sales positions generally offer a competitive On Target Earnings (OTE) incentive compensation structure.

Please note that the base pay shown is a guideline, and individual total compensation will vary based on factors such as qualifications, skill level, competencies, and work location. We also offer health plans, including flexible spending accounts, a 401(k) Plan with company match, ESPP, matching donations, a flexible time away plan and family leave programs.

Compensation is based on the geographic location in which the role is located and is subject to change based on work location.

Additional Information

Work Personas We approach our distributed world of work with flexibility and trust. Work personas (flexible, remote, or required in office) are categories that are assigned to ServiceNow employees depending on the nature of their work and their assigned work location. Learn more here.

To determine eligibility for a work persona, ServiceNow may confirm the distance between your primary residence and the closest ServiceNow office using a third-party service. Accommodations We strive to create an accessible and inclusive experience for all candidates.

Export Control Regulations For positions requiring access to controlled technology subject to export control regulations, including the U.S. Export Administration Regulations (EAR), ServiceNow may be required to obtain export control approval from government authorities for certain individuals.

All employment is contingent upon ServiceNow obtaining any export license or other approval that may be required by relevant export control authorities. From Fortune. ©2026 Fortune Media IP Limited. All rights reserved. Used under license.