Staff Security Risk Analyst

Okta • Washington, DC

3d • $148,000 - $228,000 • Hybrid

About The Position

The Staff Security Risk Analyst will help advance Okta’s security risk management program by identifying, assessing, monitoring, and reporting operational, security, and compliance risks. The role drives technical automation across the risk lifecycle, including engineering AI agents, scripts, capabilities, and workflows to improve risk data processing and operational scale. It evaluates security controls, tracks deficiencies, coordinates engineering remediation, and conducts root-cause analysis and post-incident reviews.

The analyst partners with risk owners and cross-functional teams to develop mitigation plans, govern risk acceptance and exceptions, manage the risk register and issue lifecycle, and provide leadership with dynamic risk visibility. The role applies industry practices and regulatory frameworks, advises on security controls, and develops analytics workflows, KRIs, KPIs, assessment methodologies, playbooks, and procedures. It also supports program maturity, risk-awareness initiatives, and other security, program, and GRC projects.

This position requires the ability to access federal environments and/or protected federal data. The successful candidate must be able to submit documentation establishing U.S. Person status upon hire. Okta describes an immersive, in-person onboarding experience. Salary ranges vary by location: $166,000–$228,000 annually in the San Francisco Bay Area, and $148,000–$204,000 annually in California (excluding the Bay Area), Colorado, Illinois, New York, and Washington. Equity, where applicable, bonus, and benefits are also offered.

Requirements

• Relevant BA/BS degree.
• At least 7 years of hands-on security risk management and technical experience.
• Hands-on experience building automated workflows, scripts using Python/APIs, and AI agentic solutions.
• Security industry certification such as CRISC, CISA, CISM, CISSP, or equivalent certification.
• Experience with regulations and common industry frameworks, including ISO, PCI, NIST CSF, and COSO.
• Track record of influencing technical and business stakeholders to drive risk remediation and process adoption.
• Strong knowledge of agile tools and GRC solutions.
• Excellent verbal, written, and interpersonal skills.
• Ability to manage multiple priority initiatives and deliver under tight timelines.
• Comfort with ambiguity and adaptability in fast-changing environments.
• Ability to access federal environments and/or protected federal data, and ability to provide documentation establishing U.S. Person status upon hire.

Nice To Haves

• Experience in Third-Party Risk Management, including hands-on vendor security assessments and overall program operations.

Responsibilities

• Identify, assess, monitor, and report on operational, security, and compliance risks.
• Build technical automation across the risk management lifecycle, including custom AI agents, capabilities, and workflows to optimize risk data processing and scale operations.
• Evaluate security control effectiveness, track deficiencies, and drive engineering remediation through completion.
• Conduct root-cause analysis of control deficiencies and post-incident reviews to identify underlying gaps and prevent recurrence.
• Partner with risk owners to develop mitigation plans aligned with the risk management strategy.
• Govern the formal risk acceptance and exception process.
• Manage the risk register and issue lifecycle to provide leadership with dynamic risk visibility.
• Apply industry best practices for risk management and advise on applying regulatory and industry frameworks to Okta’s security posture.
• Build partnerships across teams to establish a cohesive view of security, compliance, and operational risks and drive remediation to completion.
• Serve as a security and technology subject matter expert, advising on the design and adoption of security controls, particularly those intended to meet regulatory requirements.
• Develop data analytics workflows and establish KRIs and KPIs for team metrics and executive reporting.
• Develop, maintain, and refine standardized risk assessment methodologies, playbooks, and procedures.
• Advance security risk management program maturity and execution in alignment with company goals and security strategy.
• Drive risk-awareness initiatives and promote a security-minded risk culture across business units.
• Support ad hoc projects, including program enhancements, security initiatives, and other GRC functions.

Benefits

• Equity, where applicable.
• Bonus.
• Health insurance.
• Dental insurance.
• Vision insurance.
• 401(k).
• Flexible spending account.
• Paid leave, including PTO and parental leave, in accordance with applicable plans and policies.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior