Note: The job is a remote job and is open to candidates in USA. OpenAI is an AI research and deployment company dedicated to ensuring that general-purpose artificial intelligence benefits all of humanity. They are seeking a deeply technical Product Manager to help build Codex security controls and the partner ecosystem around them, focusing on securing Codex products and defining standard interfaces for customer and partner systems.
Responsibilities
- Build native security controls for Codex
- Partner with engineering, design, security, and safety teams to develop controls for:
- Identity, roles, permissions, and tenant isolation
- Access to repositories, files, tools, MCP servers, secrets, networks, and infrastructure
- Read, write, execute, and deployment authority
- Human and policy-based approvals
- Prompt-injection and untrusted-content defenses
- Audit trails, provenance, stop conditions, revocation, and rollback
- Help establish a graduated authority model in which local, read-only, and reversible actions require less friction than actions involving production systems, credentials, sensitive data, or irreversible changes
- Define partner interfaces
- Develop common, versioned interfaces that allow customer-selected security products to participate in Codex workflows
- These interfaces may support:
- Sharing trusted identity, task, resource, and environment context
- Inspecting code, commands, artifacts, tool calls, or planned actions
- Returning allow, deny, constrain, or require-approval decisions
- Exporting normalized execution and security telemetry
- Pausing activity, revoking access, or requiring reauthorization
- Define clear requirements for authentication, authorization, customer consent, data minimization, latency, retries, failure behavior, auditability, and backwards compatibility
- Ensure integrations use shared platform contracts rather than creating a different Codex architecture for every partner
- Build the partner ecosystem
- Work directly with security vendors and enterprise design partners to turn the interfaces into production integrations
- Create partner SDKs, reference implementations, technical documentation, test environments, conformance suites, and certification requirements
- Prioritize partners based on customer value, technical relevance, deployment readiness, and their ability to improve the shared platform—not simply logo value or launch timing
- Turn lessons from individual partner engagements into reusable product capabilities
- Shape the customer experience
- Define how enterprise administrators configure and understand Codex security controls, including:
- Policies by user, workspace, repository, environment, tool, or action
- Approved security providers and permitted data sharing
- Approval requirements and time-limited exceptions
- Policy inheritance and conflict resolution
- Audit, investigation, and incident-response workflows
- Ensure developers receive clear, actionable explanations when an action is blocked or requires approval, rather than an opaque policy error
- Establish evaluation and launch gates
- Work with security, safety, research, and engineering teams to test whether controls work under realistic and adversarial conditions
- Evaluate risks such as permission bypass, prompt injection, malicious tools, secret exposure, cross-tenant access, stale authorization, partner outages, conflicting decisions, and incomplete audit evidence
- Help determine when new Codex capabilities have sufficient controls, reliability, and usability for broader deployment
Skills
- Have built enterprise security, developer-platform, infrastructure, or control-plane products
- Understand identity, authorization, sandboxing, secrets, tool use, APIs, and audit systems
- Think naturally in terms of trust boundaries, failure modes, and abuse paths
- Can balance security, developer productivity, latency, reliability, and customer control
- Have experience building integrations across complex enterprise systems or partner ecosystems
- Can turn conflicting partner requirements into a coherent platform
- Communicate credibly with developers, security architects, CISOs, researchers, and partner product teams
- Prefer measurable security outcomes and real adoption over demonstrations or integration announcements
- Experience in application security, identity, cloud security, data security, source control, CI/CD, SIEM, or enterprise governance
- Familiarity with RBAC, ABAC, policy-as-code, OAuth, OIDC, workload identity, or secrets management
- Experience with AI agents, MCP, sandboxed execution, prompt-injection defenses, or agent-security evaluations
- Experience building SDKs, developer platforms, integration marketplaces, or certification programs
Company Overview
Company H1B Sponsorship