SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Legora is an AI-native legal workspace trusted by 2,100+ customers across 80+ countries, including major law firms like Cleary Gottlieb, Goodwin, and Linklaters. The company has scaled to $200M+ ARR and operates teams across Europe, North America, and APAC.
You will own Legora's Okta platform and build the security controls that protect employees, applications, devices, and data. This is a hands-on individual contributor role with end-to-end responsibility for Okta architecture, engineering, governance, and operations. You will set technical direction, make architecture decisions, build integrations and automation, and remain accountable for production performance.
Key responsibilities include:
- Full ownership of Okta platform: roadmap, architecture, configuration, security posture, integrations, change management, and operational reliability. Set standards for authentication, authorization, administrative access, and recovery. Serve as the final technical escalation point for complex Okta issues.
- Authentication and application integrations: Design and troubleshoot SSO, SAML, OIDC, OAuth, and SCIM integrations. Own phishing-resistant MFA, risk-based authentication, session controls, and device-aware access policies. Build secure application onboarding with configuration validation, named owners, approvals, and controlled secret handling.
- Identity lifecycle and access governance: Build reliable joiner, mover, and leaver workflows connecting HR systems, Okta, directories, and business applications. Own provisioning, entitlement changes, timely revocation, and downstream access management. Establish access reviews, least-privilege controls, privileged access standards, and accountable application ownership.
- Identity engineering and automation: Build production software using Python and JavaScript, Okta APIs, Workflows, and Terraform or other infrastructure-as-code tools. Put configuration and controls under version control with peer review, testing, and safe deployment. Design for retries, partial failures, observability, rollback, and recovery.
- Non-human identity and agent authorization: Establish ownership, least privilege, credential lifecycle, and revocation for service accounts, API tokens, integrations, and AI agents. Build authorization controls for agent and MCP access with clear permission boundaries, approval requirements, and audit trails.
You will work in Legora's Union Square office designed for ambitious builders, with company-provided lunch daily. The role offers global collaboration with teams across Europe, APAC, and North America.
REQUIREMENTS:
- Typically 8-10+ years of relevant experience in identity engineering, IT infrastructure, or corporate security, with demonstrated expert-level Okta ownership. Experience depth and scope of ownership are assessed rather than a fixed years minimum.
- Expert-level, hands-on Okta experience including architecture, complex integrations, lifecycle management, authentication policies, governance, and production troubleshooting. Must have personally owned an enterprise Okta environment.
- Deep understanding of SAML, OIDC, OAuth, SCIM, federation, authentication, and authorization. Ability to diagnose integration failures, unsafe access paths, and incomplete deprovisioning across interconnected systems.
- Demonstrated production engineering with Python and/or JavaScript, APIs, and Terraform or equivalent infrastructure-as-code. Must show evidence of testing, deploying, monitoring, and recovering automation.
- Experience delivering broader corporate security controls across SaaS, endpoints, device trust, and data protection, with judgment to prioritize risks and carry remediation through to completion.
- Independent technical ownership: define technical roadmap, lead complex work across teams, make sound security decisions, remain accountable for production outcomes. Communicate directly, work constructively through disagreement, and raise technical standards.
USEFUL ADDITIONAL EXPERIENCE:
- HR-driven identity modernization, Workday integrations, Active Directory retirement, or directory consolidation.
- Self-service application onboarding.
- Identity governance and privileged access.
- Non-human identity, AI-agent, or MCP security.
- Okta certifications (demonstrated engineering depth and ownership matter most).
