Staff/Principal Identity Engineer
$216k - $292k • Remote • New York City • FullTime
Posted 6h ago
About the job
Legora is seeking a hands-on Staff/Principal Identity Engineer to take full ownership of the company's Okta platform. This role involves building and maintaining security controls to protect employees, applications, devices, and data. You will be responsible for the end-to-end lifecycle of the Okta platform, including its architecture, engineering, governance, and operations. The ideal candidate will have expert-level Okta capabilities and will set the technical direction, make architectural decisions, build integrations and automation, and ensure the platform's production performance. This position also requires engineering controls across various security domains, including SaaS applications, endpoint and device trust, data protection, non-human identities, and AI usage.
Responsibilities
- Own the Okta platform roadmap, architecture, configuration, security posture, integrations, change management, and operational reliability.
- Set standards for authentication, authorization, administrative access, and recovery.
- Serve as the final technical escalation point for complex Okta issues and ensure their resolution.
- Design and troubleshoot SSO, SAML, OIDC, OAuth, and SCIM integrations.
- Own phishing-resistant MFA, risk-based authentication, session controls, and device-aware access policies.
- Build secure application onboarding processes with configuration validation, named owners, approvals, and controlled secret handling.
- Develop reliable workflows for identity lifecycle management, connecting HR systems, Okta, directories, and business applications.
- Manage provisioning, entitlement changes, and timely revocation of access.
- Establish access reviews, least-privilege controls, privileged access standards, and accountable application ownership.
- Build production software using Python and JavaScript, Okta APIs, Workflows, and infrastructure-as-code tools like Terraform.
- Implement version control for configuration and controls with peer review, testing, and safe deployment.
- Design for resilience, including retries, partial failures, observability, rollback, and recovery.
- Reduce manual work through reliable automation.
- Establish ownership, least privilege, credential lifecycle, and revocation for non-human identities and AI agents.
- Build authorization controls for agent and MCP access with clear permission boundaries, approval requirements, and audit trails.
Requirements
- Typically 8-10+ years of relevant experience in identity engineering, IT infrastructure, or corporate security.
- Demonstrated expert-level Okta ownership.
- Expert-level, hands-on Okta experience, including architecture, complex integrations, lifecycle management, authentication policies, governance, and production troubleshooting.
- Deep understanding of SAML, OIDC, OAuth, SCIM, federation, authentication, and authorization.
- Ability to diagnose integration failures, unsafe access paths, and incomplete deprovisioning across interconnected systems.
- Demonstrated production engineering experience with Python and/or JavaScript, APIs, and Terraform or equivalent infrastructure as code.
- Experience delivering broader corporate security controls across SaaS, endpoints, device trust, and data protection.
- Ability to prioritize risks and carry remediation through to completion.
- Independent technical ownership: define technical roadmaps, lead complex work, make sound security decisions, and remain accountable for production outcomes.
- Strong communication skills, ability to work constructively through disagreement, and raise the technical standard.
Benefits
- Competitive salary
- Comprehensive benefits
- Tools for success
- Global collaboration opportunities