Staff Product Security Engineer

The Security Team

Okta is The World's Identity Company. We free everyone to safely use any technology—anywhere, on any device or app. Our Workforce and Customer Identity Clouds enable secure yet flexible access, authentication, and automation that transform how people move through the digital world, putting Identity at the heart of business security and growth.

Staff Product Security Engineer Opportunity

The Security team's mission is to strengthen Okta's position as the leading Identity-as-a-service solutions provider by identifying and resolving risks to employees, products, and, most importantly, our customers.

• Conduct offensive security research focused on agentic AI systems: prompt injection, agent privilege escalation, tool-binding abuse, and agentic supply chain attacks against internal developer platforms.
• Perform security assessments of Okta's AI platforms—including agentic systems and LLM-integrated products—across design, code, and runtime.
• Build reusable security tooling that multiplies the entire Product Security team's capability.
• Run the AI security vendor and tooling evaluation program: design and operate a benchmarking harness against AI security tools.
• Develop threat models for agentic architectures, orchestration layers, and LLM-integrated services.
• Translate research findings into actionable guidance for engineering teams building AI-powered features and platforms.
• Represent Okta externally through security research, conference presentations, white papers, and publications.
• Mentor engineers across Product Security on AI/agentic security concepts, tooling, and assessment methodology.

What You Will Do

• Conduct offensive security research focused on agentic AI systems: prompt injection, agent privilege escalation, tool-binding abuse, and agentic supply chain attacks against internal developer platforms.
• Perform security assessments of Okta's AI platforms—including agentic systems and LLM-integrated products—across design, code, and runtime.
• Build reusable security tooling that multiplies the entire Product Security team's capability.
• Run the AI security vendor and tooling evaluation program: design and operate a benchmarking harness against AI security tools.
• Develop threat models for agentic architectures, orchestration layers, and LLM-integrated services.
• Translate research findings into actionable guidance for engineering teams building AI-powered features and platforms.
• Represent Okta externally through security research, conference presentations, white papers, and publications.
• Mentor engineers across Product Security on AI/agentic security concepts, tooling, and assessment methodology.

What You Bring

• 7+ years of experience in information security, with meaningful depth in application security, offensive research, or AI/ML security.
• Demonstrated hands-on experience assessing LLM-integrated systems and agentic AI architectures—not just familiarity with the concepts, but evidence of having found real vulnerabilities in them.
• A strong offensive mindset: the ability to model what an adversary does with an agentic system, identify where the model's reasoning or the orchestration layer breaks down, and construct scenarios that make the risk concrete.
• Experience building security tooling and automation—scripts, scanners, detection logic, or evaluation harnesses—that other engineers actually use.
• Advanced experience in threat modeling, manual code review, and penetration testing, applied to complex distributed systems.
• Knowledge of authentication and authorization protocols (OIDC, OAuth 2.0, SAML) and their implementation risks.
• Strong communication skills: the ability to write clearly for technical and non-technical audiences, document research findings with precision, and present at external venues.
• Experience producing external security research—publications, conference talks, blog posts, or open-source tooling.

Desired Skills and Abilities

• Familiarity with agentic framework internals (tool-use protocols, MCP, function-calling patterns, agent orchestration architectures).
• Experience with SAST, DAST, SCA, and fuzzing tooling applied to AI/ML pipelines or CI/CD systems.
• Strong cryptographic knowledge and experience in identifying cryptographic implementation flaws.
• Ability to develop proof-of-concept exploits that demonstrate AI/agentic vulnerabilities to engineering and product leadership.
• Experience contributing to security standards, SDL processes, or vulnerability research programs.

Annual Base Salary Range

The annual base salary range for this position for candidates located in the San Francisco Bay area is between: $180,000 USD - $247,000 USD

Below is the annual base salary range for candidates located in California (excluding San Francisco Bay Area), Colorado, Illinois, New York and Washington. Your actual base salary will depend on factors such as your skills, qualifications, experience, and work location. In addition, Okta offers equity (where applicable), bonus, and benefits, including health, dental and vision insurance, 401(k), flexible spending account, and paid leave (including PTO and parental leave) in accordance with our applicable plans and policies. To learn more about our Total Rewards program please visit: https://rewards.okta.com/us.

The annual base salary range for this position for candidates located in California (excluding San Francisco Bay Area), Colorado, Illinois, New York, and Washington is between: $161,000 USD - $221,000 USD

If reasonable accommodation is needed to complete any part of the job application, interview process, or onboarding please use this Form to request an accommodation.

Notice for New York City Applicants & Employees: Okta may use Automated Employment Decision Tools (AEDT), as defined by New York City Local Law 144, that use artificial intelligence, machine learning, or other automated processes to assist in our recruitment and hiring process. In accordance with NYC Local Law 144, if you are an applicant or employee residing in New York City, please click here to view our full NYC AEDT Notice.