Legora
Staff/Principal Identity Engineer
$216K–$292K
New York City · On-site · Principal · Full-time · Posted Oct 11, 2026
- Experience
- Typically 8–10+ years of relevant experience; the posting says experience depth and scope of ownership are assessed rather than applying a fixed minimum.
About the job
Own and engineer Legora’s Okta identity platform and security controls across employees, applications, devices, data, service identities, and AI agents.
What you'll do
- Set the Okta roadmap and own its architecture, configuration, integrations, security, and operational reliability.
- Build authentication, application integration, identity lifecycle, access governance, and automation capabilities.
- Establish least-privilege and authorization controls for service accounts, API tokens, integrations, and AI agents.
What they ask for
- Expert hands-on Okta ownership, including architecture, integrations, lifecycle management, authentication policies, governance, and production troubleshooting.
- Deep understanding of SAML, OIDC, OAuth, SCIM, federation, authentication, and authorization.
- Production engineering experience with Python and/or JavaScript, APIs, and Terraform or equivalent infrastructure as code.
- Experience delivering corporate security controls across SaaS, endpoints, device trust, and data protection.
Nice to have
- HR-driven identity modernization, Workday integrations, Active Directory retirement, or directory consolidation.
- Experience with identity governance, privileged access, non-human identity, AI-agent or MCP security; Okta certifications are useful.
Pay
$215.9K – $292.1K USD base salary
Tools
Okta, Python, JavaScript, Terraform, SAML, OIDC, OAuth, SCIM
AI focus
Build authorization controls for AI agents and MCP access, including permission boundaries, approvals, and audit trails; manage AI-agent identities and credentials.
Model-written summary · the original posting is authoritative