Engineering Manager – Workload Identity & Secrets Platform

Additional Information

For Los Angeles County (unincorporated) Candidates:

Qualifications

• 2+ years managing software or infrastructure engineering teams, including senior or staff ICs
• 7+ years total engineering experience, with hands-on background in backend systems, distributed infrastructure, or platform engineering
• Direct experience with secrets management or identity infrastructure — Vault or equivalent, OIDC, PKI, certificate lifecycle, least-privilege access models
• Complementary — genuinely not required
• External Secrets Operator, SPIFFE/SPIRE, or workload identity federation
• Experience in a regulated or audited environment (SOC 2, ISO 27001, FedRAMP)
• Vendor evaluation and contract negotiation for infrastructure tooling
• Working fluency in Kubernetes and infrastructure-as-code (Terraform/HCL, Helm)
• A track record of building internal platforms other engineers actually adopted, plus the influence to drive migrations across teams you don't control
• Comfort operating a service other teams depend on: SLOs, incident management, on-call
• Additional Information
• This role may also be eligible for Equity Compensation and/or Bonus Incentive Compensation. Procore is committed to offering competitive, fair, and commensurate compensation. Actual compensation will be based on a candidate’s job-related skills, experience, education or training, and location.
• This position requires access to technology, software, and data that is controlled or restricted under U.S. law, regulation, executive order, or government contract.
• Procore will consider for employment all qualified applicants, including those with arrest or conviction records, in accordance with the requirements of applicable federal, state, and local laws, including the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act.
• A criminal history may have a direct, adverse, and negative relationship on the following job duties, potentially resulting in the withdrawal of the conditional offer of employment: 1. appropriately managing, accessing, and handling confidential information including proprietary and trade secret information, as well as accessing Procore's information technology systems and platforms; 2. interacting with and occasionally having unsupervised contact with internal/external customers, stakeholders, and/or colleagues; and 3. exercising sound judgment.

Responsibilities

• The migration off static credentials. Driving adoption of dynamic, identity-based credentials across Procore's service estate — not just building the platform, but getting teams to move onto it.
• Developer experience for secrets. Self-service provisioning, credential lifecycle, certificate rotation, and the standards that make the secure path the easy path.
• The team. Hiring, growing, and retaining engineers across US and international time zones, including career development for senior and staff ICs in a narrow specialty.
• Reliability of a Tier-0 dependency. When the secrets platform degrades, deploys stop. SLOs, on-call health, and incident response are yours.
• Partnership with Security Engineering. Aligning platform investment against real compliance and audit obligations without turning your team into a ticket queue.
• Prioritization under ambiguity. This domain generates far more demand than a six-person team can absorb. Deciding what not to do is a core part of the job.
• What we're looking for:
• 2+ years managing software or infrastructure engineering teams, including senior or staff ICs
• 7+ years total engineering experience, with hands-on background in backend systems, distributed infrastructure, or platform engineering
• Direct experience with secrets management or identity infrastructure — Vault or equivalent, OIDC, PKI, certificate lifecycle, least-privilege access models
• Complementary — genuinely not required
• External Secrets Operator, SPIFFE/SPIRE, or workload identity federation
• Experience in a regulated or audited environment (SOC 2, ISO 27001, FedRAMP)
• Vendor evaluation and contract negotiation for infrastructure tooling
• Working fluency in Kubernetes and infrastructure-as-code (Terraform/HCL, Helm)
• A track record of building internal platforms other engineers actually adopted, plus the influence to drive migrations across teams you don't control
• Comfort operating a service other teams depend on: SLOs, incident management, on-call
• Additional Information
• Base Pay Range:
• This role may also be eligible for Equity Compensation and/or Bonus Incentive Compensation. Procore is committed to offering competitive, fair, and commensurate compensation. Actual compensation will be based on a candidate’s job-related skills, experience, education or training, and location.
• This position requires access to technology, software, and data that is controlled or restricted under U.S. law, regulation, executive order, or government contract.
• For Los Angeles County (unincorporated) Candidates:
• Procore will consider for employment all qualified applicants, including those with arrest or conviction records, in accordance with the requirements of applicable federal, state, and local laws, including the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act.
• A criminal history may have a direct, adverse, and negative relationship on the following job duties, potentially resulting in the withdrawal of the conditional offer of employment: 1. appropriately managing, accessing, and handling confidential information including proprietary and trade secret information, as well as accessing Procore's information technology systems and platforms; 2. interacting with and occasionally having unsupervised contact with internal/external customers, stakeholders, and/or colleagues; and 3. exercising sound judgment.