Cybersecurity Governance, Risk, Compliance & Trust Leader – AI Security Programs

Job Description

Sr Principal, GRC | Workday

The Tone:
This is a full-time role at Workday, located in Pleasanton, California, USA, with a hybrid work approach. Workday is a Fortune 500 company and a leading AI platform for managing people, money, and agents, dedicated to shaping the future of work. This role is crucial for building and sustaining trust in Workday’s cybersecurity commitments, which enables business growth and protects the data of Workmates and over 8000 customers. You will act as a trusted advisor and change agent across Workday by embedding a cybersecurity-first mindset and delivering cybersecurity assurance.

The TL;DR
• Role: Full Time
• Type: Full-time
• Location: Hybrid – Pleasanton, California, USA
• Pay: $215500–$323300 yearly
• Team: Workday Cybersecurity Governance, Risk, Compliance & Trust team
• Mission: Drive enterprise-wide cybersecurity programs and architect strategic Cybersecurity & Trust transformational programs to ensure successful adoption and achievement of strategic objectives.

What You’ll Actually Do
• Program Leadership: Lead large cross-functional cybersecurity programs, including the cybersecurity communications program, within a matrixed organization from concept to success.
• Strategic Transformation Architecture: Architect strategic Cybersecurity & Trust transformational programs, providing leadership, driving process design, and developing internal automation and cybersecurity solutions.
• AI-First Operational Engineering: Develop and implement the people, process, and technology transformations required to transition functional operations into continuous, data-driven, AI-first engineering programs, including architecting for security data integration and Agentic AI orchestration.
• Security Governance Industrialization: Refine existing workflows, optimize cybersecurity tooling, and industrialize security governance and control enforcement by driving the adoption of policy-as-code and secure Infrastructure as Code (IaC) practices.
• AI Security Customer Engagement: Work cross-functionally to design processes and enable tools for consistent responses to AI-related customer questions, and operate as an executive cybersecurity voice for thought leadership with customers, prospects, and industry groups.

The Must-Haves
• Background: Minimum 12 years experience as a GRC or business leader, conceiving and implementing GRC strategies, driving improvements in risk management and compliance effectiveness, and influencing overall organizational governance. Bachelor’s degree in Business Administration, Law, Finance, Information Security, or a related discipline.
• Experience: Minimum 10+ years in GRC domains, regulatory landscapes, and GRC technologies. Proven ability to strategically and proactively apply prioritization techniques to lead critical and complex GRC or Cybersecurity initiatives, anticipating future challenges and aligning with executive vision. Proven experience building, implementing, and running programs from scratch within an enterprise environment.
• Skills: Exceptional written and verbal communication skills under intense pressure, with the ability to translate complex technical risks for non-technical executives. Exceptional mastery in relationship building, cultivating influential relationships with executive leadership, the board of directors, and key external stakeholders. Expert-level understanding of risk analysis methodologies. Exceptional mastery in stakeholder management, building consensus and influencing executive leadership and external partners on critical GRC strategies.
• Bonus: Master’s degree preferred or equivalent practical experience. Experience leading cybersecurity technical and transformation programs in collaboration with cross-functional cybersecurity teams, including being hands-on with cybersecurity telemetry and metrics to support design and program progress indicators. Experience writing, evaluating, and remediating internal audit reports and driving technical remediation to closure. Experience analyzing technical cybersecurity data for strategic decision-making purposes.