Staff/Principal Identity Engineer

Legora•New York, NY

12d•$215,900 - $292,100•Onsite

About The Position

We are looking for a hands-on Staff/Principal Identity Engineer to own Legora's Okta platform and build the security controls that protect our employees, applications, devices and data. This is an individual contributor role with end-to-end responsibility for Okta architecture, engineering, governance and operations. Expert-level Okta capability is the most important requirement. You will set the technical direction, make architecture decisions, build integrations and automation, and remain accountable for how the platform performs in production. You will also engineer controls across SaaS applications, endpoint and device trust, data protection, non-human identities and AI usage.

Requirements

Typically 8-10+ years of relevant experience in identity engineering, IT infrastructure or corporate security, with demonstrated expert-level Okta ownership. We assess the depth of your experience and the scope of your ownership rather than a fixed years-of-experience minimum.
Expert-level, hands-on Okta experience, including architecture, complex integrations, lifecycle management, authentication policies, governance and production troubleshooting. You have personally owned an enterprise Okta environment and can explain the decisions, tradeoffs and outcomes of your work.
Deep understanding of SAML, OIDC, OAuth, SCIM, federation, authentication and authorization. You can diagnose integration failures, unsafe access paths and incomplete deprovisioning across interconnected systems.
Demonstrated production engineering with Python and/or JavaScript, APIs and Terraform or equivalent infrastructure as code. You can show how you test, deploy, monitor and recover your automation.
Experience delivering broader corporate security controls across SaaS, endpoints, device trust and data protection, with the judgment to prioritize risks and carry remediation through to completion.
Independent technical ownership: define the technical roadmap, lead complex work across teams, make sound security decisions and remain accountable for production outcomes. Communicate directly, work constructively through disagreement and raise the technical standard around you.

Nice To Haves

HR-driven identity modernization, Workday integrations, Active Directory retirement or directory consolidation.
Self-service application onboarding.
Identity governance and privileged access.
Non-human identity, AI-agent or MCP security.
Okta certifications are useful, but demonstrated engineering depth and ownership matter most.

Responsibilities

Full ownership of Okta: Own the platform roadmap, architecture, configuration, security posture, integrations, change management and operational reliability. Set standards for authentication, authorization, administrative access and recovery. Be the final technical escalation point for complex Okta issues and own their resolution.
Authentication and application integrations: Design and troubleshoot SSO, SAML, OIDC, OAuth and SCIM integrations. Own phishing-resistant MFA, risk-based authentication, session controls and device-aware access policies. Build secure application onboarding with configuration validation, named owners, approvals and controlled secret handling.
Identity lifecycle and access governance: Build reliable joiner, mover and leaver workflows connecting HR systems, Okta, directories and business applications. Own provisioning, entitlement changes and timely revocation, including downstream access and active sessions. Establish access reviews, least-privilege controls, privileged access standards and accountable application ownership.
Identity engineering and automation: Build production software using Python and JavaScript, Okta APIs, Workflows and Terraform or other infrastructure-as-code tools. Put configuration and controls under version control with peer review, testing and safe deployment. Design for retries, partial failures, observability, rollback and recovery. Reduce manual work through reliable automation.
Non-human identity and agent authorization: Establish ownership, least privilege, credential lifecycle and revocation for service accounts, API tokens, integrations and AI agents. Build authorization controls for agent and MCP access, with clear permission boundaries, approval requirements and audit trails.

Benefits

Competitive package: Comprehensive salary, benefits, and tools for success.
Medical, Dental & Vision
Multiple medical plan options through Aetna and Kaiser Permanente
HSA or Healthcare FSA (based on plan selection)
Dental plans via MetLife
Vision plans via Vision Care
Generous parental leave
Free access to Maven Clinic
Dependent Care FSA
Free One Medical membership for employees and dependents
Pre-tax commuter benefits
Life Insurance + STD/LTD
401(K) with generous company match
Unlimited PTO
Robust voluntary benefits, including identity protection (via Aura), legal coverage via MetLife, pet savings programs, and more.