Engineering Manager – Workload Identity & Secrets Platform

Procore runs thousands of services across multiple production regions, and too many of them still authenticate with static, long-lived credentials. We're replacing that model with a Vault-backed identity platform where credentials are short-lived, issued on demand, and tied to workload identity — not to a secret someone pasted into a config file three years ago. We're hiring an Engineering Manager to lead the team that owns that platform. You'll manage a focused team of 4–6 engineers, including senior and staff ICs already deep in this domain, and own the roadmap for how every engineer at Procore gets, rotates, and retires a credential. To be straightforward about the shape of the job: this is a small, senior team, so you'll be partnering closely with your engineers on the ground. Success in this role requires a balance of strong team leadership and technical credibility. You won't be the primary implementer — your staff engineers own the designs and write the code — but rather than managing purely from a distance, you’ll be actively engaged in architectural decisions, making defensible build-vs-buy calls, and building deep system context to help the team navigate tradeoffs and tackle complex, specialized work together. This position reports to a Senior Manager within the Developer Acceleration group and will be based in our Austin,TX office.   We're looking for someone to join us immediately. What you'll do: The migration off static credentials. Driving adoption of dynamic, identity-based credentials across Procore's service estate — not just building the platform, but getting teams to move onto it. Developer experience for secrets. Self-service provisioning, credential lifecycle, certificate rotation, and the standards that make the secure path the easy path. The team. Hiring, growing, and retaining engineers across US and international time zones, including career development for senior and staff ICs in a narrow specialty. Reliability of a Tier-0 dependency. When the secrets platform degrades, deploys stop. SLOs, on-call health, and incident response are yours. Partnership with Security Engineering. Aligning platform investment against real compliance and audit obligations without turning your team into a ticket queue. Prioritization under ambiguity. This domain generates far more demand than a six-person team can absorb. Deciding what not to do is a core part of the job. What we're looking for: 2+ years managing software or infrastructure engineering teams, including senior or staff ICs 7+ years total engineering experience, with hands-on background in backend systems, distributed infrastructure, or platform engineering Direct experience with secrets management or identity infrastructure — Vault or equivalent, OIDC, PKI, certificate lifecycle, least-privilege access models Complementary — genuinely not required External Secrets Operator, SPIFFE/SPIRE, or workload identity federation …