Staff Product Security Engineer

The Security Team

Okta is The World's Identity Company. We free everyone to safely use any technology—anywhere, on any device or app. Our Workforce and Customer Identity Clouds enable secure yet flexible access, authentication, and automation that transform how people move through the digital world, putting Identity at the heart of business security and growth.

At Okta, we celebrate a variety of perspectives and experiences. We are not looking for someone who checks every box—we're looking for lifelong learners and people who can improve us with their unique experiences.

Join our team! We're building a world where Identity belongs to you.

The Staff Product Security Engineer Opportunity

The Security team's mission is to strengthen Okta's position as the leading Identity-as-a-service solutions provider by identifying and resolving risks to employees, products, and, most importantly, our customers.

The Staff AI Product Security Engineer joins a team with a clear mission: to shape the future of application security by researching and building systems that prove how AI can fundamentally augment, automate, and scale defense. This is a hybrid research, offensive and software engineering role centered on leveraging AI to uncover vulnerabilities, automate root cause analysis, automate exploitation, and generate secure code patches at cloud scale.

This role is built for engineers who want to push the limits of what AI can do for security, from benchmarking SOTA frontier models and fine-tuning open-weight models to building production-grade security tooling across Product Security. While a main focus will be on creating intelligent, automated security capabilities that keep Okta continuously ahead of emerging threats, performing full security reviews of Okta's products, as well as agentic architectures and internal AI pipelines, to uncover, exploit and fix vulnerabilities is also part of the work.

The ideal candidate thinks creatively but also like an attacker, builds like an engineer, and publishes their findings. We actively support external research disclosure through white papers, blog posts, and conference presentations.

What You Will Do

• Lead technical capability research evaluating frontier LLMs and customized open-weight models for advanced code analysis, autonomous attack and logical security reasoning.
• Engineer production-grade, AI-assisted security tools that automate vulnerability discovery, triaging, and risk validation across codebases.
• Architect context-aware code-repair engines that automatically recommend verified security fixes to software development teams.
• Build automated Proof-of-Concept (PoC) exploit generators in sandboxed runtimes to safely perform root cause analysis on identified vulnerabilities.
• Modify and fine-tune open-source models to carry out domain-specific defensive and offensive code analysis tasks.
• Embed AI models, unified APIs, and model-agnostic execution frameworks across Product Security tools to multiply team capabilities.
• Assess and secure internal AI platforms, agentic execution runtimes, and AI coding agent container environments.
• Perform manual code review and AI-assisted deep dives of Okta's products and system implementations across multiple languages. 
• Develop threat models for agentic architectures, orchestration layers, and LLM-integrated services.
• Deliver technical reference blueprints and publish external research demonstrating how AI models transform modern security engineering.
• Run the AI security vendor and tooling evaluation program: design and operate a benchmarking harness against AI security tools.
• Conduct offensive security research focused on agentic AI systems: prompt injection, agent privilege escalation, tool-binding abuse, and agentic supply chain attacks against internal developer platforms.
• Translate research findings into actionable guidance for engineering teams building AI-powered features and platforms.

What You Bring

• 8+ years of experience in information security, with meaningful depth in application security, offensive research, or AI/ML security.
• Experience building security tooling and automation (scripts, scanners, detection logic, or evaluation harnesses) that other engineers actually use.
• Strong offensive mindset: the ability to model what an adversary does to break systems and how this translates to an agentic system, identify where the model's reasoning or the orchestration layer breaks down, and construct scenarios that make the risk concrete.
• Demonstrated hands-on experience assessing LLM-integrated systems and agentic AI architectures, not just familiarity with the concepts, but evidence of having found real vulnerabilities in them.
• Proficiency in at least two programming languages (Python and one of: Go, Java, TypeScript, C/C++).
• Advanced experience in threat modeling, manual code review, and penetration testing, applied to complex distributed systems.
• Knowledge of authentication and authorization protocols (OIDC, OAuth 2.0, SAML) and their implementation risks.
• Strong communication skills: the ability to write clearly for technical and non-technical audiences, document research findings with precision, and present at external venues.
• Experience producing external security research, publications, conference talks, blog posts, or open-source tooling.

Desired Skills and Abilities

• Experience in vulnerability research and vulnerability discovery through source code auditing, as well as penetration testing skills.
• Familiarity with agentic framework internals (tool-use protocols, MCP, function-calling patterns, agent orchestration architectures).
• Experience with SAST, DAST, SCA, and fuzzing tooling applied to AI/ML pipelines or CI/CD systems.
• Strong cryptographic knowledge and experience in identifying cryptographic implementation flaws.
• Ability to develop proof-of-concept exploits that demonstrate vulnerabilities to engineering and product leadership. Plus, if able to exploit AI/Agentic-specific vulnerabilities
• Experience contributing to security standards, SDL processes, or vulnerability research programs.

#LI-SM1

#LI-Hybrid
#LI-Remote

P25264_3461996