{"id":2306083,"url":"https://alion.io/job/legora-staffprincipal-identity-engineer","title":"Staff/Principal Identity Engineer","company":{"id":48110,"name":"Legora","domain":"legora.com","url":"https://alion.io/company/legora","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":87,"open_postings":81,"ghost_share":0,"stale_share":0.531,"repost_share":0,"time_to_fill_p50_days":53,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Industrial Engineering","role_family":"Industrial Engineering","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":215900,"max":292100,"currency":"USD","period":"year","gross":null,"usd_annual":292100},"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"AI Agents","optional":false},{"name":"JavaScript","optional":false},{"name":"Least Privilege","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"Okta","optional":false},{"name":"Python","optional":false},{"name":"Terraform","optional":false}],"status":"live","first_seen_at":"2026-10-11T19:22:44Z","employer_posted_date":"2026-10-11","last_verified_at":"2026-10-18T21:00:37Z","board_verified":true,"closed_at":null,"days_open":7,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":7},"description":"About Us\nLegora is redefining how legal work gets done. Not built for lawyers, built with them. We work alongside the world’s best legal teams, who expect excellence, precision, and speed, and we hold ourselves to the same bar.\nOur AI-native workspace lets legal professionals move faster, think more clearly, and operate with sharper precision. By analysing thousands of documents in minutes and powering end-to-end workflows, we cut through complexity, teams can focus on what matters: judgment, strategy, and outcomes.\n2,100+ customers across 80+ countries trust us, including Cleary Gottlieb, Goodwin, Linklaters, White & Case, Dentons, and Barclays. We’ve scaled to $200M+ in ARR, with teams across Europe, North America and APAC, and continue to expand through acquisitions including Qura, Walter AI, Graceview, Cadastral, and Wexler.\nWe partner with world-class performers: including Aaron Judge and the New York Yankees, Ludvig Åberg (and his caddie), and campaigns featuring Jude Law.\nJoining Legora means three things.\nWe lean in: ownership over titles, outcomes over intentions.\n\nWe fight for excellence: high standards, direct, ego-free feedback.\n\nWegrow together: as a team and with our customers.\n\nMission before ego. Everyone contributes. No one coasts.\nIf you’re driven by impact, pace, and raising the bar. This is the place.\nThe role\nWe are looking for a hands-on Staff/Principal Identity Engineer to own Legora's Okta platform and build the security controls that protect our employees, applications, devices and data. This is an individual contributor role with end-to-end responsibility for Okta architecture, engineering, governance and operations.\nExpert-level Okta capability is the most important requirement. You will set the technical direction, make architecture decisions, build integrations and automation, and remain accountable for how the platform performs in production. You will also engineer controls across SaaS applications, endpoint and device trust, data protection, non-human identities and AI usage.\nWhat you will own\nFull ownership of Okta: Own the platform roadmap, architecture, configuration, security posture, integrations, change management and operational reliability. Set standards for authentication, authorization, administrative access and recovery. Be the final technical escalation point for complex Okta issues and own their resolution.\n\nAuthentication and application integrations: Design and troubleshoot SSO, SAML, OIDC, OAuth and SCIM integrations. Own phishing-resistant MFA, risk-based authentication, session controls and device-aware access policies. Build secure application onboarding with configuration validation, named owners, approvals and controlled secret handling.\n\nIdentity lifecycle and access governance: Build reliable joiner, mover and leaver workflows connecting HR systems, Okta, directories and business applications. Own provisioning, entitlement changes and timely revocation, including downstream access and active sessions. Establish access reviews, least-privilege controls, privileged access standards and accountable application ownership.\n\nIdentity engineering and automation: Build production software using Python and JavaScript, Okta APIs, Workflows and Terraform or other infrastructure-as-code tools. Put configuration and controls under version control with peer review, testing and safe deployment. Design for retries, partial failures, observability, rollback and recovery. Reduce manual work through reliable automation.\n\nNon-human identity and agent authorization: Establish ownership, least privilege, credential lifecycle and revocation for service accounts, API tokens, integrations and AI agents. Build authorization controls for agent and MCP access, with clear permission boundaries, approval requirements and audit trails.\n\nWhat you will bring\nTypically 8-10+ years of relevant experience in identity engineering, IT infrastructure or corporate security, with demonstrated expert-level Okta ownership. We assess the depth of your experience and the scope of your ownership rather than a fixed years-of-experience minimum.\n\nExpert-level, hands-on Okta experience, including architecture, complex integrations, lifecycle management, authentication policies, governance and production troubleshooting. You have personally owned an enterprise Okta environment and can explain the decisions, tradeoffs and outcomes of your work.\n\nDeep understanding of SAML, OIDC, OAuth, SCIM, federation, authentication and authorization. You can diagnose integration failures, unsafe access paths and incomplete deprovisioning across interconnected systems.\n\nDemonstrated production engineering with Python and/or JavaScript, APIs and Terraform or equivalent infrastructure as code. You can show how you test, deploy, monitor and recover your automation.\n\nExperience delivering broader corporate security controls across SaaS, endpoints, device trust and data protection, with the judgment to prioritize risks and carry remediation through to completion.\n\nIndependent technical ownership: define the technical roadmap, lead complex work across teams, make sound security decisions and remain accountable for production outcomes. Communicate directly, work constructively through disagreement and raise the technical standard around you.\n\nUseful additional experience\nHR-driven identity modernization, Workday integrations, Active Directory retirement or directory consolidation.\n\nSelf-service application onboarding.\n\nIdentity governance and privileged access.\n\nNon-human identity, AI-agent or MCP security.\n\nOkta certifications are useful, but demonstrated engineering depth and ownership matter most.\n\nWhat’s In It For You\nGlobal collaboration: Partner with teams and clients across Europe, APAC, and North America.\n\nCompetitive package: Comprehensive salary, benefits, and tools for success.\n\nMeaningful work: Your efforts shape how thousands of lawyers use AI daily.\n\nIn-person environment: Union Square office designed for ambitious builders and company provided lunch daily.\n\nBenefits & Perks: We invest in our people with a comprehensive, thoughtfully designed benefits package: Medical, Dental & Vision\nMultiple medical plan options through Aetna and Kaiser Permanente\n\nHSA or Healthcare FSA (based on plan selection)\n\nDental plans via MetLife\n\nVision plans via Vision Care\n\nFamily Support\nGenerous parental leave\n\nFree access to Maven Clinic\n\nDependent Care FSA\n\nFree One Medical membership for employees and dependents\n\nAdditional Perks\nPre-tax commuter benefits\n\nLife Insurance + STD/LTD\n\n401(K) with generous company match\n\nUnlimited PTO\n\nRobust voluntary benefits, including identity protection (via Aura), legal coverage via MetLife, pet savings programs, and more\n\nLegora is an Equal Opportunity Employer\nAt Legora, we believe great teams are built on diversity of thought and experience. We’re proud to be an equal opportunity employer and committed to creating an inclusive, high-performance culture where everyone can do their best work. We welcome people of all backgrounds and don’t discriminate based on race, color, religion, national origin, gender, gender identity or expression, sexual orientation, age, disability, veteran status, or any other characteristic protected by law.","description_format":"text","description_chars":7288,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Life insurance","Parental leave","Unlimited PTO"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Document AI","Legal AI","Legal Software"],"lifecycle":[{"event":"open","at":"2026-10-11T22:58:11Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 1","filings_12m":1,"filings_prev_12m":0,"green_card_filings_12m":0,"median_offered_wage_usd":162500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":5,"expected_fill_days":53,"reasons":["conf:3","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":{"stated_usd_annual":292100,"is_top_pay":true},"html_url":"https://alion.io/job/legora-staffprincipal-identity-engineer","json_url":"https://alion.io/job/legora-staffprincipal-identity-engineer.json","meta":{"generated_at":"2026-10-18T23:30:06Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":26014,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-19T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":48110},"rest":"https://alion.io/mcp/rest/get_company?id=48110"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Flegora-staffprincipal-identity-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Flegora-staffprincipal-identity-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Flegora-staffprincipal-identity-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/legora-staffprincipal-identity-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Flegora-staffprincipal-identity-engineer"}]}