Principal Product Manager, IAM Security & Agentic Identity

Secure Every Identity, from AI to Human

Identity is the key to unlocking the potential of AI. Okta secures AI by building the trusted, neutral infrastructure that enables organizations to safely embrace this new era. This work requires a relentless drive to solve complex challenges with real‑world stakes. We are looking for builders and owners who operate with speed and urgency and execute with excellence. This is an opportunity to do career‑defining work.

We’re all in on this mission. If you are too, let’s talk.

The Identity team's mission is to secure the world’s identity connections while building the foundational trust layer for the modern enterprise. As organizations successfully adopt phishing‑resistant MFA, attackers have shifted their tactics—deploying adversary‑in‑the‑middle phishing kits and info‑stealer malware to execute session hijacking via cookie theft. With the explosive rise of autonomous AI workloads, securing human identity is no longer enough; we must now protect and govern a fast‑growing sprawl of non‑human, agentic workflows.

We are looking for a highly mature, customer‑obsessed, and technically curious Principal Product Manager to drive our Identity Security & Agentic Identity portfolio. In this role, you will be a cornerstone of the “Okta on Okta” team, acting as Customer Zero. You will report directly to the VP of IAM and shepherd cutting‑edge features from Alpha through Early Availability, guaranteeing we are our own first and best customer before these solutions scale to the rest of the world.

Because identity security is a rapidly evolving frontier, this role focuses on professional maturity, strategic judgment, and autonomous operation. You will act as a critical bridge—implementing capabilities internally, capturing real‑world insights, and directly shaping the core Okta and Auth0 product roadmaps.

As the Principal PM, you will drive the strategy and directly influence the product direction for Okta’s premier identity security offerings across both our workforce and developer platforms:

• AI Agent & Agentic Identity Security:
  Leading the strategy for how Okta governs non‑human, autonomous AI workloads across our entire product ecosystem:
  • O4AA (Okta for AI Agents) & A4AA (Auth0 for AI Agents):
    Defining authentication and authorization patterns for workforce and developer‑facing AI agents.
  • Next‑Gen Guardrails:
    Managing token exchange patterns, identity/security gateways, and the Model Context Protocol (MCP) to secure agent‑to‑data interactions.
• Hardware‑Bound Session Security:
  Architecting Okta's defense against session cookie thievery by leveraging cryptographically hardware‑bound tokens. This includes owning the strategy for Okta Device Bound SSO (DBSSO) and Google Chrome Device Bound Session Credentials (DBSC).
• Advanced Threat & Posture Management:
  Integrating Identity Threat Protection (ITP) for continuous risk evaluation and Identity Security Posture Management (ISPM) to surface and remediate hidden risks across human and machine identities.

• Roadmap Influence & Strategy:
  Develop and refine the strategic roadmap for the Identity Security portfolio. Act as a key stakeholder who directly shapes and prioritizes the core Okta and Auth0 product roadmaps based on internal deployment findings.
• Champagne Lifecycle Management (Alpha to EA):
  Ensure that as Alpha features are released, Okta’s internal IAM team rigorously tests them and provides real‑time feedback through the SDLC process. Own the internal rollout of these features through Early Availability, driving adoption so Okta successfully “drinks its own champagne.”
• Anti‑Session Hijacking Architecture:
  Design the internal rollout blueprint and external product strategy for how Okta DBSSO and Chrome DBSC complement one another, creating a layered defense that protects corporate endpoints from token and cookie exfiltration.
• Agentic Governance:
  Define the operational and technical guardrails for deploying AI agents internally and externally—ensuring secure integration via identity gateways, down‑scoped runtime permissions, and…