Product Security Engineer Jobs in San Francisco, CA

The Identity Team

The Identity team's mission is to secure the world's identity connections while building the foundational trust layer for the modern enterprise. As organizations successfully adopt phishing-resistant MFA, attackers have shifted their tactics—increasingly deploying Adversary-in-the-Middle (AiTM) phishing kits and info-stealer malware to execute session hijacking via cookie theft. Furthermore, with the explosive rise of autonomous AI workloads, securing human identity is no longer enough; we must now protect and govern a fast-growing sprawl of non-human, agentic workflows.

The Principal Product Manager Opportunity

We are looking for a highly mature, customer-obsessed, and technically curious Principal Product Manager to drive our Identity Security & Agentic Identity portfolio. In this role, you will be a cornerstone of the "Okta on Okta" team, acting as Customer Zero. You will report directly to the VP of IAM to ensure Okta "drinks our own champagne." You will shepherd cutting-edge features from Alpha through Early Availability (EA)—guaranteeing we are our own first and best customer before these solutions scale to the rest of the world.

Because identity security is a rapidly evolving frontier, this role is less about hitting a specific year-count and more about your professional maturity, strategic judgment, and ability to operate autonomously. You will act as a critical bridge—implementing capabilities internally, capturing real-world insights, and directly influencing and shaping the core Okta and Auth0 Product roadmaps.

Key Portfolio Focus Areas

As the Principal PM, you will drive the strategy and directly influence the product direction for Okta's premier identity security offerings across both our workforce and developer platforms:

• AI Agent & Agentic Identity Security: Leading the strategy for how Okta governs non-human, autonomous AI workloads across our entire product ecosystem:\
  • O4AA (Okta for AI Agents) & A4AA (Auth0 for AI Agents): Defining authentication and authorization patterns for workforce and developer-facing AI agents.
  • Next-Gen Guardrails: Managing token exchange patterns, identity/security gateways, and the Model Context Protocol (MCP) to secure agent-to-data interactions.
• Hardware-Bound Session Security: Architecting Okta's defense against session cookie thievery by leveraging cryptographically hardware-bound tokens. This includes owning the strategy for Okta Device Bound SSO (DBSSO) and Google Chrome Device Bound Session Credentials (DBSC).
• Advanced Threat & Posture Management: Integrating Identity Threat Protection (ITP) for continuous risk evaluation and Identity Security Posture Management (ISPM) to surface and remediate hidden risks across human and machine identities.

What you'll be doing

• Roadmap Influence & Strategy: Develop and refine the strategic roadmap for the Identity Security portfolio. Act as a key stakeholder who directly shapes and prioritizes the core Okta and Auth0 Product roadmaps based on internal deployment findings.
• Champagne Lifecycle Management (Alpha to EA): Ensure that as Alpha features are released, Okta's internal IAM team rigorously tests them and provides real-time feedback through the SDLC process. Own the internal rollout of these features through Early Availability (EA), driving adoption so Okta successfully "drinks its own champagne."
• Anti-Session Hijacking Architecture: Design the internal rollout blueprint and external product strategy for how Okta DBSSO and Chrome DBSC complement one another, creating a layered defense that protects corporate endpoints from token and cookie exfiltration.
• Agentic Governance: Define the operational and technical guardrails for deploying AI Agents internally and externally—ensuring secure integration via identity gateways, downscoped runtime permissions, and an unbreakable audit trail.
• Execution & Technical Delivery: Act as the primary liaison between business units, development, and engineering teams. Lead planning activities, author comprehensive PRDs/user stories, and prioritize features within Scrum/Kanban frameworks.
• Metrics & Insights: Define and monitor KPI-based reporting to provide the VP of IAM and executive leadership with clear visibility into portfolio scope, security coverage, and testing velocity across human and non-human identities.

What you'll bring to the role

• Professional Maturity & Experience: Demonstrated success operating at a Principal level within Product Management, Technical Program Management, or Enterprise Architecture. Experience in IAM technologies, developer platforms (like Auth0), enterprise security, or machine-to-machine infrastructure is highly valued, but your proven ability to lead through influence is paramount.
• AI & Developer Tech Literacy: A strong conceptual and technical grasp of how AI agents, LLM applications, security gateways, and developer APIs handle authentication, authorization, and modern communication patterns (like MCP and OAuth 2.0).
• Session Security & Threat Literacy: A strong technical understanding of modern identity threat vectors (AiTM phishing, info-stealer malware, session hijacking) and how cryptographic hardware-binding (TPM, Secure Enclave) protects session state.
• Strategic Influence: A track record of successfully influencing product roadmaps and engineering priorities across highly matrixed, global organizations without direct reporting authority.
• Navigating Ambiguity: Exceptional analytical and problem-solving skills; the ability to maintain composure and produce concrete action plans from incomplete, conflicting, or highly ambiguous inputs.
• Executive Presence: Elite presentation, verbal, and written communication skills, with the confidence to brief executive leadership and translate deep technical architecture into compelling business value.

#LI-MC1

#LI-Hybrid

#P21720_3472537