Staff Engineer, AI Agent Gateway & Identity

Okta; San Francisco (CA); On-site; USD 194,000 - 267,000; Full time

Benefits offered by this job

Equity

Bonus

Health insurance

Dental insurance

Vision insurance

401(k)

Paid leave

Job summary

Okta in the San Francisco Bay Area is seeking a Staff Software Engineer to anchor the Agent Gateway team, owning critical data and control plane components and guiding architectural design as MCP and agent identity specs evolve.

You will work close to the metal on routing, token exchange, credential resolution, and policy evaluation, while also shaping config bundles and tenant fanout for scalable deployments.

Qualifications

• 7+ years building distributed, highly available production backend systems.
• Hands-on experience shipping production services in Java and/or Go.
• Strong grounding in OAuth 2.0, OIDC, and RFC 8693 token exchange.
• Proven success in shipping identity, authorization, or edge-of-network services at scale.
• Experience with agentic development tools (e.g., Claude Code, MCP servers, AI-assisted code review).
• Excellent technical design documentation and communication.

Responsibilities

• Architect and Lead: Own end-to-end design and delivery of gateway capabilities, including on-prem deployment models.
• Design for Security and Runtime: set standards for credentials, tokens, tenant isolation, and audit logging.
• Move With the Protocols: Shape MCP, OAuth token exchange, and agent identity specs.
• Ship With Agentic Tooling: Use Claude Code and MCP-connected agents in workflows.
• Raise the Bar: Drive code review, testing, observability, and design docs; mentor engineers.
• Collaborate across groups to align on architecture and operational rollout.

Skills

Java

Go

Distributed systems

OAuth 2.0

OIDC

RFC 8693

Agentic tooling

Job description

Okta in the San Francisco Bay Area is seeking a Staff Software Engineer to anchor the Agent Gateway team, owning critical data and control plane components and guiding architectural design as MCP and agent identity specs evolve.

You will work close to the metal on routing, token exchange, credential resolution, and policy evaluation, while also shaping config bundles and tenant fanout for scalable deployments.