Principal Product Security Engineer, Reviews

As a Principal Product Security Engineer, you will drive security strategy, mentor engineers, and lead security initiatives that have a broad impact across Okta’s products. You will be responsible for conducting high-level security assessments, architectural reviews, and penetration tests, while also influencing engineering teams on secure design, development, and risk mitigation.

This role requires deep expertise in product security, with the ability to independently define, build, and implement security programs that scale across multiple teams. You will also serve as a trusted security advisor, collaborating with senior leadership, engineering, and product teams to proactively address complex security challenges.

The ideal candidate is a technical leader who can think like an attacker, identify systemic security gaps, and drive large-scale security improvements. You will also have the opportunity to publish research, contribute to security standards, and represent Okta at industry events.

Job Duties and Responsibilities:

• Lead and define product security strategy, collaborating with engineering and leadership teams.
• Independently assess and improve security programs, driving initiatives that enhance Okta’s overall security posture.
• Conduct deep-dive security reviews, including architectural assessments, threat modeling, and penetration testing.
• Identify and address systemic security weaknesses, providing strategic guidance on mitigation and long-term improvements.
• Mentor and advise engineers across the company on security best practices and emerging threats.
• Drive cross-functional security initiatives, ensuring alignment across product, engineering, and leadership teams.
• Investigate and respond to high-impact security incidents, leading root cause analysis and driving remediation efforts.
• Represent Okta externally by contributing to security research, publishing findings, and speaking at industry events.

Required Knowledge, Skills, and Abilities:

• Expert-level knowledge of application security, penetration testing, and secure architecture design.
• Strong experience in threat modeling, security risk analysis, and large-scale security program development.
• Deep understanding of authentication and authorization protocols (OIDC, SAML, OAuth).
• Ability to influence and guide engineering teams on security best practices at scale.
• Strong coding and automation skills in Python, Go, or other modern languages.
• Proven experience leading security incidents, risk assessments, and vulnerability management.
• Excellent communication skills, with the ability to engage executive leadership and engineering teams on security topics.

 Desired Skills and Abilities:

• Experience in secure software development lifecycle (SSDLC) implementation.
• Knowledge of modern cryptographic algorithms and secure system design.
• Experience with container security, cloud security, and infrastructure security.
• Deep understanding of network security, protocol analysis, and large-scale threat detection.
• Strong ability to drive security culture and advocate for security at all levels of an organization.

#LI-Remote

#LI-JP3