Senior Product Security Researcher

Job description

We're reimagining enterprise Identity and Access Management from the ground up. Founded by serial entrepreneurs Shai Morag and Tal Marom and backed by a $60M seed round from Greylock, Accel, and CRV, we're building the next generation of identity security. Identity is the gateway to everything- who's let in, who's kept out, and it's now the number one attack vector in the enterprise. The tools built to govern it were designed for a slower world of human users and static environments. That world is gone. Identities are exploding across human, machine, and AI agents faster than legacy systems can track, and security teams are left patching together five disconnected tools that still can't answer "who has access to what, right now." We think the answer isn't another point solution- it's a new foundation. Oak is the AI-native Identity Operating System: an AI connector framework that reaches any application, a live identity graph built from raw evidence, and a team of AI agents that governs the full lifecycle of every identity in one platform. We're building Oak's AI-native core from day one-engineered for what enterprise identity is becoming, not patched onto what it used to be. And we're just getting started. About the Role: Oak's Research is where deep security expertise becomes product. We translate how identity is weaponized and becomes an attack path - across human, machine, and AI agent identities - into the risk models and security content that exposes real identity risk inside customer environments. Research here doesn't end in a slide deck, it ships. As a Security Researcher, you'll own and evolve the core of the Oak platform: the frameworks and logics that turn fragmented, cross-surface identity data into precise, high-signal insight. You'll work directly with real-world data to find emerging attack patterns, reason about privilege and exposure, and convert what you learn into intelligence that tells customers what's actually risky - and what to do about it. Identity is also the fastest-moving attack surface in the enterprise right now. The explosion of non-human identities and autonomous AI agents is rewriting what "who has access to what" even means, and you'll be at the front of it — defining how Oak discovers, scores, governs and secures these identities before the rest of the market has a vocabulary for the risk. You'll also shape Oak's voice in the field. Through original research, published findings, and technical thought leadership, you'll influence how practitioners and analysts understand identity risk as the perimeter dissolves. What you will Do: • Drive research end-to-end - from hypothesis and exploration all the way through to the intelligence and logic that ship into the platform and makes impact on our customers. • Translate deep expertise in identity and security into the analytical engine that drives how Oak reasons about risk, governance, and access decisions across organizations. • Create and own Oak knowledge - the content, logic and intelligence behind every insight made, while setting and maintaining the quality, accuracy depth and coverage of the platform. • Pioneer Oak's approach at the cutting edge of a category being reinvented - as the identity foundations are rebuilt for a new world • Shape the field's understanding of identity through original research and technical thought leadership, while raising the research bar across the team and delivering top-tier value to our customers. What you will bring: • 5+ years of hands-on security research experience, with a track record that demonstrates depth across identity, access control, or adjacent threat domains. • Low ego, high impact - you share findings freely, measure success by the team's impact and you are value-driven, Willing to roll up your sleeves for the foundational work creating knowledge and insights in order to provide real value to real customers. • Innovative and forward thinking - Continuous desire to learn, explore and create. • The instinct to find what others miss: you approach identity attack surfaces, NHI exposure, and AI agent behavior with genuine curiosity and a willingness to go where the research leads. • A collaborative default - happy to share and work alongside product, engineering, and go-to-market teams in order to translate raw research into intelligence that sharpens Oak's platform and customers' understanding of their identity risk. Nice to have: • A history of original, published work - conference presentations (Black Hat, DEFCON, or equivalent), blog series, or white papers that has moved the needle and made impact.