SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 141,000 - 193,000 / annual
Okta is seeking a Staff Product Security Engineer to safeguard its identity and access management platforms. In this role, you will conduct comprehensive security reviews, guide engineering teams in secure development practices, and manage externally reported vulnerabilities. You will perform manual code reviews, penetration testing, and architectural security assessments across Okta's products and features.
Key responsibilities include:
- Conducting security reviews including design reviews, threat modeling, and penetration testing of new features and major changes
- Performing manual secure code reviews across multiple programming languages
- Identifying and mitigating security vulnerabilities with clear guidance to engineering teams
- Leading product security incidents, assessing risks, and driving remediation efforts
- Developing security tools and automation to improve vulnerability detection
- Mentoring junior engineers and providing guidance on secure development practices
- Representing Okta externally through security research, conference talks, and publications
This role requires deep technical expertise and an attacker mindset. You will not rely solely on automated vulnerability scanning; instead, you must possess comprehensive understanding of web applications, backend services, penetration testing methodologies, and secure design principles. The ideal candidate will have expertise in authentication protocols (SAML, OAuth, OIDC), threat modeling, and experience securing AI-integrated software architectures and Large Language Models (LLMs) against emerging threats.
Okta actively supports public disclosure of research and findings through white papers, blog posts, and conference presentations.
REQUIREMENTS:
- Expertise in identifying OWASP Top 10 / CWE Top 25 vulnerabilities through manual code review
- Strong experience in penetration testing and secure development practices
- Deep technical background in assessing Large Language Models (LLMs) and securing AI-integrated software architectures
- Proficiency in multiple programming languages (Java, Go, Python, C/C++)
- Deep understanding of authentication & authorization protocols (OIDC, SAML, OAuth)
- Strong communication skills to explain risks and remediation to developers and leadership
- Ability to automate security testing using LLMs and scripting (Python, Bash, etc.)
- Experience leading security incidents and risk assessments
DESIRED SKILLS:
- Experience in mobile (iOS/Android) and desktop (Windows/macOS) security testing
- Familiarity with SAST, DAST, SCA, and fuzzing tools
- Strong cryptographic knowledge and secure implementation practices
- Experience analyzing network protocols and traffic security
- Ability to develop proof-of-concept exploits to demonstrate vulnerabilities
