Staff Product Security Engineer

About the role

The Security Team at Okta is dedicated to strengthening the company's position as the leading Identity-as-a-service solutions provider. This involves identifying and resolving risks to employees, products, and, most importantly, our customers. The Staff Product Security Engineer Opportunity focuses on researching and engineering to anticipate and mitigate security risks introduced by agentic systems.

Responsibilities

• Conduct offensive security research focused on agentic AI systems: prompt injection, agent privilege escalation, tool-binding abuse, and agentic supply chain attacks against internal developer platforms.
• Perform security assessments of Okta's AI platforms—including agentic systems and LLM-integrated products—across design, code, and runtime.
• Build reusable security tooling that multiplies the entire Product Security team's capability.
• Run the AI security vendor and tooling evaluation program: design and operate a benchmarking harness against AI security tools.
• Perform manual code review of AI and agent-based system implementations across multiple languages.
• Develop threat models for agentic architectures, orchestration layers, and LLM-integrated services.
• Translate research findings into actionable guidance for engineering teams building AI-powered features and platforms.
• Represent Okta externally through security research, conference presentations, white papers, and publications.
• Mentor engineers across Product Security on AI/agentic security concepts, tooling, and assessment methodology.

Requirements

The ideal candidate must have 7+ years of experience in information security, with meaningful depth in application security, offensive research, or AI/ML security. They should demonstrate hands-on experience assessing LLM-integrated systems and agentic AI architectures, not just familiarity with the concepts. The candidate must think like an attacker, build like an engineer, and publish their findings. Proficiency in at least two programming languages (Python and one of: Go, Java, TypeScript, C/C++) is required, along with advanced experience in threat modeling, manual code review, and penetration testing, applied to complex distributed systems. Knowledge of authentication and authorization protocols (OIDC, OAuth 2.0, SAML) and their implementation risks is essential. Strong communication skills, including the ability to write clearly for technical and non-technical audiences, document research findings with precision, and present at external venues, are also necessary. Experience producing external security research—publications, conference talks, blog posts, or open-source tooling—is desired.

Qualifications

The ideal candidate must have a strong offensive mindset, the ability to model what an adversary does with an agentic system, identify where the model's reasoning or the orchestration layer breaks down, and construct scenarios that make the risk concrete. Experience building security tooling and automation—scripts, scanners, detection logic, or evaluation harnesses—that other engineers actually use is crucial. Advanced experience in cryptographic knowledge and experience in identifying cryptographic implementation flaws is desired. Experience developing proof-of-concept exploits that demonstrate AI/agentic vulnerabilities to engineering and product leadership is highly valued. Experience contributing to security standards, SDL processes, or vulnerability research programs is also desirable.

Skills

• Familiarity with agentic framework internals (tool-use protocols, MCP, function-calling patterns, agent orchestration architectures).
• Experience with SAST, DAST, SCA, and fuzzing tooling applied to AI/ML pipelines or CI/CD systems.
• Strong cryptographic knowledge and experience in identifying cryptographic implementation flaws.
• Ability to develop proof-of-concept exploits that demonstrate AI/agentic vulnerabilities to engineering and product leadership.
• Experience contributing to security standards, SDL processes, or vulnerability research programs.

Benefits

At Okta, we offer a competitive compensation package, including a range of benefits such as health, dental, and vision insurance, a 401(k) plan, a flexible spending account, and paid leave (including PTO and parental leave). For more information on our Total Rewards program, please visit here.

Pay

The annual base salary range for this position for candidates located in the San Francisco Bay area is between $180,000—$247,000 USD. Below is the annual base salary range for candidates located in California (excluding San Francisco Bay Area), Colorado, Illinois, New York, and Washington. Your actual base salary will depend on factors such as your skills, qualifications, experience, and work location.

Schedule

This role is available on a hybrid schedule, offering a combination of remote and in-office work options.