Sr Principal, GRC

Location: USA, CA, Pleasanton

Your work days are brighter here.

We’re obsessed with making hard work pay off, for our people, our customers, and the world around us. As a Fortune 500 company and a leading AI platform for managing people, money, and agents, we’re shaping the future of work so teams can reach their potential and focus on what matters most. The minute you join, you’ll feel it. Not just in the products we build, but in how we show up for each other. Our culture is rooted in integrity, empathy, and shared enthusiasm.

We’re in this together, tackling big challenges with bold ideas and genuine care. We look for curious minds and courageous collaborators who bring sun-drenched optimism and drive. Whether you're building smarter solutions, supporting customers, or creating a space where everyone belongs, you’ll do meaningful work with Workmates who’ve got your back. In return, we’ll give you the trust to take risks, the tools to grow, the skills to develop and the support of a company invested in you for the long haul.

So, if you want to inspire a brighter work day for everyone, including yourself, you’ve found a match in Workday, and we hope to be a match for you too.

About the Team

Workday Cybersecurity Governance, Risk, Compliance & Trust team builds and sustains trust in Workday's cybersecurity commitments by embedding a cybersecurity-first mindset, delivering cybersecurity assurance and enabling business growth. We act as trusted advisors and change agents across Workday to protect the data of our fellow Workmates and 8000+ customers.

About the Role

We are seeking a technical cybersecurity leader with a proven track record delivering large cross-functional programs from concept to success. You will need to be comfortable leading in a matrixed organization to drive enterprise-wide cybersecurity programs including, but not limited to, the cybersecurity communications program. Additionally, you will be the architect for strategic C&T transformational programs, working with the C&T leadership team, providing strategic leadership, driving process design and transformation, and architecting the development of internal automation and cybersecurity solutions to ensure successful adoption and overall effectiveness of organizational scale and achievement of strategic objectives.

Responsibilities

AI-First Operational Transformation

Operational Engineering Evolution: Develop and implement the people, process, and technology transformations required to transition functional operations into continuous, data-driven, AI-first engineering programs, including architecting for security data integration and Agentic AI orchestration.

Process & Technology Transformation: Refine existing workflows to eliminate bottlenecks, optimize cybersecurity tooling, and ensure the team is focused on high-value risk mitigation, including industrializing security governance and control enforcement by driving the adoption of policy-as-code and secure Infrastructure as Code (IaC) practices at scale.

Talent Upskilling: Foster a deep cybersecurity mindset and drive talent upskilling initiatives across the organization to support program adoption.

Advanced Metrics: Institute Key Performance Indicators (KPIs) and automated dashboards that measure the effectiveness of our processes, organizational adoption, and the achievement of strategic objectives.

AI Security Customer Engagement

Work cross-functionally (including but not limited to Legal, GCO, Product, Platform, and Cybersecurity) to design processes and enable tools to drive consistency in Workday’s position and response to AI-related prospect and customer questions.

Working with security risk, Legal, GCO and industry as well as regulatory partners, identify AI-cybersecurity topics that require positioning statements and drive efforts to secure investment, design and deliver solutions that mitigate evolving AI-security risks. Translate efforts into external facing communications that can be leveraged in the market.

Govern talk tracks and supporting materials that reflect the current Workday’s positioning on cybersecurity AI topics. Enable Chief Security Advisors and other Workday AI representatives to represent emerging cybersecurity AI topics with clarity and confidence.

Operate as a representative of the executive cybersecurity voice - engaging with customers, prospects and industry groups to deliver thought leadership and security knowledge that bolsters Workday’s security brand.

About You

Basic Qualifications

Minimum of 12 years experience as a GRC or business leader, conceiving and implementing innovative GRC strategies, driving improvements in risk management and compliance effectiveness, and influencing overall organizational governance.

Minimum of 10+ experience in GRC domains, regulatory landscapes, and GRC technologies.

Bachelor’s degree in a relevant discipline such as Business Administration, Law, Finance, Information Security, or a related discipline; a Master's degree preferred or equivalent practical experience.

Other Qualifications

Proven ability to strategically and proactively apply Prioritization techniques to lead and direct the organization's most critical and complex GRC or Cybersecurity initiatives, anticipating future challenges and aligning with executive vision.

Experience with driving cross-functional cybersecurity alignment across a global workforce and lead by influence across departmental lines without direct authority.

Proven experience building, implementing, and running programs from scratch within an enterprise environment.

Exceptional written and verbal communication skills under intense pressure, with the ability to translate complex technical risks for non-technical executives.

Exceptional mastery in Relationship Building and the ability to cultivate and leverage deep, influential relationships with executive leadership, the board of directors, and key external stakeholders to advance Cybersecurity objectives.

Expert-level understanding of Risk Analysis methodologies.

Exceptional mastery in Stakeholder Management and the ability to build unshakeable consensus and influence executive leadership, the board of directors, and key external partners on the organization's most critical GRC strategies and initiatives.

Experience leading cybersecurity technical and transformation programs in collaboration with cross functional cybersecurity teams, including experience being hands on with cybersecurity telemetry and metrics to support design and program progress indicators

Experience writing, evaluating and remediating Internal Audit reports and driving technical remediation to closure.

Experience analyzing technical cybersecurity data, such as vulnerability management SLA results by functional team, and using this data for strategic decision making purposes.

Exceptional written and verbal communication skills under intense pressure, with the ability to translate complex technical risks for non-technical executives and working closely with technical leaders and executives across product, technology, cybersecurity and legal.

Experience handling interpersonal relationships and highly confidential matters with a high degree of self-awareness and discretion.

Workday Pay Transparency Statement

The annualized base salary ranges for the primary location and any additional locations are listed below. Workday pay ranges vary based on work location. As a part of the total compensation package, this role may be eligible for the Workday Bonus Plan or a role-specific commission/bonus, as well as annual refresh stock grants. Recruiters can share more detail during the hiring process. Each candidate’s compensation offer will be based on multiple factors including, but not limited to, geography, experience, skills, job duties, and business need, among other things. For more information regarding Workday’s comprehensive benefits, please click here.

Primary Location: USA.CA.Pleasanton

Primary Location Base Pay Range: $215,500 USD - $323,300 USD

Additional US Location(s) Base Pay Range: $182,000 USD - $323,300 USD

Our Approach to Flexible Work

With Flex Work, we’re combining the best of both worlds: in-person time and remote. Our approach enables our teams to deepen connections, maintain a strong community, and do their best work. We know that flexibility can take shape in many ways, so rather than a number of required days in-office each week, we simply spend at least half (50%) of our time each quarter in the office or in the field with our customers, prospects, and partners (depending on role).

This means you'll have the freedom to create a flexible schedule that caters to your business, team, and personal needs, while being intentional to make the most of time spent together. Those in our remote "home office" roles also have the opportunity to come together in our offices for important moments that matter.

Pursuant to applicable Fair Chance law, Workday will consider for employment qualified applicants with arrest and conviction records.

Workday is an Equal Opportunity Employer including individuals with disabilities and protected veterans.

Workday is committed to providing reasonable accommodations for qualified individuals during our application process, in order to perform one or more essential functions of their job, as well as regarding the use of AI tools for employment decision-making to any degree. Please see below for more details including how to request an accommodation as a qualified veteran, due to a disability or for religious reasons, or as otherwise provided under applicable law.

Workday prohibits taking adverse action against any candidate or employee for reporting a possible violation of this policy, requesting one or more work accommodations, exercising a privacy right, or cooperating in an investigation in accordance with applicable law. Any employee who retaliates against a candidate or employee for doing so may be subject to disciplinary action, up to and including termination of employment, to the fullest extent allowable under applicable law.

If you require a reasonable accommodation, you may email [email protected], as far in advance as possible.

Are you being referred to one of our roles? If so, ask your connection at Workday about our Employee Referral process!

At Workday, we value our candidates’ privacy and data security. Workday will never ask candidates to apply to jobs through websites that are not Workday Careers.

Please be aware of sites that may ask for you to input your data in connection with a job posting that appears to be from Workday but is not.

In addition, Workday will never ask candidates to pay a recruiting fee, or pay for consulting or coaching services, in order to apply for a job at Workday.