interview_prep_doc / art_CwvZkfsvyw0

Content

{
  "markdown": "# Okta Interview Prep\n## Questions to Ask Chris Norris\n\n---\n\n## 1. Interviewer Summary\n\n**Chris Norris** is the Vice President of Identity & Access Management at Okta and the direct hiring manager for this role. He leads the \"Okta on Okta\" team \u2014 the exact organization this Principal PM reports into \u2014 making this conversation both a strategic evaluation and a working-relationship preview.\n\nChris joined Okta in August 2024, bringing roughly two years of tenure. Before Okta, he served as VP of IAM at McKesson for two years, where he led a major ITGC/SOX IAM transformation, deployed passwordless authentication strategies, and built IDP resiliency architecture that exceeded five-nines availability \u2014 a feat the vendor itself couldn't guarantee independently. His 25+ year career spans infrastructure, enterprise security, and IAM leadership across Macy's, Coca-Cola, Crawford & Company, and Dell EMC. He also holds a patent from his Dell EMC days on the CLARiiON Mirroview Persistent Fracture Log \u2014 a rare distinction for someone who went on to lead IAM organizations.\n\n**What this conversation is likely to be:**\n\n- A peer-level strategic dialogue, not a traditional interview. Chris will be evaluating whether you can operate as a Principal-level owner from day one.\n- He will probe your ability to **influence without authority** across a matrixed organization \u2014 the \"Okta on Okta\" team shapes external roadmaps but doesn't own engineering.\n- He will test your **technical depth** in session security, agentic identity, and protocol-level IAM \u2014 not just conceptual familiarity.\n- He will assess your **executive presence** and whether you can translate deep technical architecture into business value for VP-level and above audiences.\n\n**Shared context worth activating:**\n\n- Your six years at Kaiser Permanente building SOA platform infrastructure and Splunk Logging-as-a-Service maps directly to the enterprise-scale, centralized-identity-services challenge Chris has spent his career solving.\n- Your Intuit work scaling developer platform infrastructure to 675M+ engagements and reducing onboarding from weeks to minutes parallels Chris's McKesson self-service automation philosophy almost point for point.\n- Your hands-on MCP SDK work at StreamIO AI and OAuth 2.0 implementation across multiple products gives you genuine protocol-level fluency in the exact technologies this role governs.\n\nYour questions should signal that you are already thinking like the person in this seat \u2014 not someone who needs to be convinced the role is interesting.\n\n---\n\n## 2. Best Questions to Ask Chris Norris\n\n---\n\n### A. Interviewer Experience and Rapport\n\n**Question 1**\n\n> **\"You joined Okta in August 2024 to lead the 'Okta on Okta' team \u2014 what was the state of that function when you arrived, and what's been the most surprising thing about being both the customer and the product organization simultaneously?\"**\n\n**Why this is a good question:** This opens a genuine, peer-level conversation about the team's maturity and Chris's own journey. It surfaces real organizational context \u2014 friction points, inherited gaps, early wins \u2014 that you will need to navigate from day one. It also signals that you understand the structural uniqueness of the Customer Zero model and are curious about its operational reality, not just its marketing narrative.\n\n---\n\n**Question 2**\n\n> **\"At McKesson you built a fully self-service, automated rapid onboarding capability that removed the need for identity engineers in the loop \u2014 how much of that philosophy is shaping how you're structuring the Okta on Okta team's operating model today?\"**\n\n**Why this is a good question:** This demonstrates deep profile research and connects his most cited prior achievement directly to the current role's scope. It reveals how much autonomy and self-service thinking is baked into the team's DNA \u2014 which matters enormously for how you'll be expected to operate. It also opens a natural bridge to your own Intuit self-service platform work.\n\n---\n\n**Question 3**\n\n> **\"You hold a patent from your Dell EMC days on the CLARiiON Mirroview Persistent Fracture Log \u2014 that's a rare distinction for an infrastructure leader who went on to build IAM organizations. How has that inventor mindset carried forward into how you think about building novel identity capabilities at Okta?\"**\n\n**Why this is a good question:** Acknowledging a distinctive career detail builds genuine rapport and signals that you did real homework \u2014 not just a LinkedIn skim. More importantly, it reveals how Chris values technical depth and first-principles thinking, which matters for a Principal PM who will need to earn his trust and influence his roadmap priorities.\n\n---\n\n### B. Role and Team Dynamics\n\n**Question 4**\n\n> **\"For this Principal PM role, what does success look like at 30, 60, and 90 days \u2014 and is the expectation to first deeply understand the internal deployment landscape before influencing the external roadmap, or are those happening in parallel from day one?\"**\n\n**Why this is a good question:** This is the single most operationally critical question in the conversation. It clarifies whether the role is \"learn then lead\" or \"lead while learning,\" which directly affects how you should frame your onboarding approach and what you should be preparing to execute immediately. It also signals that you are already thinking about impact velocity, not just orientation.\n\n---\n\n**Question 5**\n\n> **\"The JD describes this role as a bridge between internal deployment findings and the core Okta and Auth0 product teams \u2014 how formalized is that feedback loop today, and where does the most friction tend to occur when internal insights need to change an external roadmap priority?\"**\n\n**Why this is a good question:** This surfaces the real organizational dynamics and political landscape you will navigate. The influence-without-authority challenge is the hardest part of this role, and asking about it directly \u2014 framed around process, not politics \u2014 shows strategic awareness. The answer will tell you a great deal about how much organizational air cover you'll have.\n\n---\n\n**Question 6**\n\n> **\"How is the Okta on Okta IAM team structured today \u2014 are there dedicated engineers embedded with the PM, or is this more of a product strategy function that works through the core engineering org?\"**\n\n**Why this is a good question:** This is essential for understanding whether you will have direct execution leverage or must operate purely through influence. The answer dramatically changes the day-to-day reality of the role and how you should position your own execution style.\n\n---\n\n**Question 7**\n\n> **\"The portfolio spans DBSSO, DBSC, ITP, ISPM, O4AA, and A4AA \u2014 that's a wide surface area for one Principal PM. Are these meant to be owned deeply in parallel, or is there a sequencing logic where some areas are more active right now than others?\"**\n\n**Why this is a good question:** This reveals the prioritization reality versus the aspirational JD scope. A Principal PM needs to know whether this is a focused role with a clear near-term mandate or a stretched role covering six active fronts simultaneously. The answer also helps you assess organizational maturity and whether a roadmap framework already exists or needs to be built.\n\n---\n\n### C. Technical Environment and Architecture\n\n**Question 8**\n\n> **\"On the agentic identity side \u2014 when you think about O4AA and A4AA, is the team currently working from a clean-slate architecture for agent authentication patterns, or are you adapting existing OAuth 2.0 and OIDC flows and finding the seams where they break for non-human workloads?\"**\n\n**Why this is a good question:** This tests technical alignment and reveals how greenfield versus constrained the agentic identity work actually is. It signals genuine protocol-level fluency \u2014 you're not asking \"what is agentic identity,\" you're asking where the existing standards break. Given your hands-on OAuth 2.0 implementation at StreamIO AI and your Intuit platform infrastructure work, this is a question you can have a real conversation about, not just listen to.\n\n---\n\n**Question 9**\n\n> **\"For Device Bound Session Credentials \u2014 Okta DBSSO relies on platform TPM/Secure Enclave binding while Chrome DBSC is a browser-layer credential \u2014 how mature is the internal deployment of each today, and are there endpoint management or MDM constraints inside Okta that are creating interesting edge cases?\"**\n\n**Why this is a good question:** This demonstrates deep technical preparation on the specific portfolio area you will own from day one. It also surfaces real deployment complexity \u2014 MDM constraints, endpoint heterogeneity, platform-specific TPM behavior \u2014 that will shape your internal rollout strategy. Asking about edge cases signals that you think like an implementer, not just a strategist.\n\n---\n\n**Question 10**\n\n> **\"How does the team currently instrument and measure the security coverage gap \u2014 for example, tracking what percentage of sessions are hardware-bound versus still vulnerable to cookie exfiltration \u2014 and is that telemetry something this PM role would help define, or does it already exist?\"**\n\n**Why this is a good question:** This connects directly to the KPI/metrics responsibility in the JD and reveals whether the measurement infrastructure is mature or needs to be built from scratch \u2014 a significant scope difference. Your Splunk Logging-as-a-Service work at Kaiser Permanente and your telemetry-driven prioritization work at Intuit (SQL, BigQuery) give you real credibility to follow up on whatever he describes.\n\n---\n\n### D. Culture and Working Style\n\n**Question 11**\n\n> **\"You've led large IAM organizations at McKesson and now at Okta \u2014 when a Principal PM on your team has a strong conviction that a feature isn't ready for EA but the external product team is pushing to ship, how do you expect that tension to be navigated?\"**\n\n**Why this is a good question:** This reveals Chris's actual leadership style on conflict and how much air cover you'll have when playing the Customer Zero gatekeeper role. The JD explicitly frames this PM as the internal quality gate before features reach the world. Knowing whether Chris will back that judgment \u2014 or expect you to find a diplomatic middle ground independently \u2014 is critical for evaluating fit.\n\n---\n\n**Question 12**\n\n> **\"At McKesson you implemented 'Focus Fridays' to give your team dedicated time for learning \u2014 is there a similar philosophy on the Okta on Okta team around protecting time for deep technical exploration, given how fast the agentic identity space is moving?\"**\n\n**Why this is a good question:** This shows you did your homework on Chris's leadership values beyond his job titles. It also surfaces whether the team culture supports the continuous learning this role demands \u2014 agentic identity is moving faster than any existing playbook, and a team that doesn't protect learning time will fall behind. The question frames your interest in growth as a team-level concern, not a personal ask.\n\n---\n\n**Question 13**\n\n> **\"How would you describe the working rhythm between this role and the VP level \u2014 are you looking for someone who brings you a weekly status update, or someone who operates largely autonomously and escalates only when they need a blocker cleared?\"**\n\n**Why this is a good question:** This directly calibrates the autonomy expectation and Chris's management style. For a Principal-level candidate, this is preference alignment \u2014 not reassurance-seeking. Frame it that way. The JD emphasizes \"operating autonomously\" and \"professional maturity,\" so your question should signal that you default to autonomous operation and are simply confirming the rhythm.\n\n*Softened framing if needed:*\n> *\"I tend to operate with a high degree of autonomy and bring things to leadership when I need a blocker cleared or a strategic decision made \u2014 does that match the rhythm you're looking for?\"*\n\n---\n\n### E. Growth and Development\n\n**Question 14**\n\n> **\"You've grown from Principal Storage Engineer to VP of IAM over 25 years \u2014 for someone coming in at the Principal PM level, what's the realistic growth trajectory on this team, and are there paths toward broader IAM strategy or product leadership over time?\"**\n\n**Why this is a good question:** This shows long-term thinking and ambition without being presumptuous. Grounding the question in Chris's own career arc makes it feel personal and earned rather than generic. It also signals that you're thinking about this as a career-defining move, which aligns with the JD's own framing.\n\n---\n\n**Question 15**\n\n> **\"Given that agentic identity is genuinely nascent \u2014 there's no established playbook \u2014 how does the team approach building expertise in areas where even the vendor community is still figuring things out? Are there research partnerships, standards body engagements, or other mechanisms?\"**\n\n**Why this is a good question:** This reveals the team's intellectual infrastructure for staying at the frontier. It also signals your awareness that this role requires continuous self-education \u2014 a quality the JD implicitly demands when it describes a \"rapidly evolving frontier.\" Your NeurIPS publication and ongoing ML research give you authentic credibility to engage with whatever answer he gives.\n\n---\n\n### F. Strategy and Vision\n\n**Question 16**\n\n> **\"When you think about the 'Okta on Okta' function's north star \u2014 is the ultimate goal to make Okta the world's most credible reference customer for its own products, or is there a broader ambition to turn internal learnings into a published framework or methodology that the industry can adopt?\"**\n\n**Why this is a good question:** This opens a strategic conversation about the team's external impact ambition. The answer reveals whether Chris is building an internal ops function or a thought leadership platform \u2014 two very different roles for a Principal PM to play. It also signals that you're thinking about the function's long-term value creation, not just its immediate execution mandate.\n\n---\n\n**Question 17**\n\n> **\"With AiTM attacks and session hijacking accelerating, and agentic workloads exploding simultaneously \u2014 how does the team prioritize between hardening existing human identity security versus building net-new infrastructure for non-human agents? Is there a principled framework, or is it more driven by threat intelligence signals?\"**\n\n**Why this is a good question:** This tests strategic judgment alignment and reveals whether the team has a principled prioritization model or is reactive to the loudest threat signal. For a Principal PM who will own both sides of this portfolio, understanding the prioritization philosophy is essential. Your RICE-based prioritization framework experience at Splunk gives you a natural follow-up if he asks how you've approached similar tradeoffs.\n\n---\n\n**Question 18**\n\n> **\"The Model Context Protocol is very early \u2014 it's not even a finalized standard yet. How is Okta thinking about making product bets on MCP for agent-to-data security when the underlying protocol could still shift significantly?\"**\n\n**Why this is a good question:** This demonstrates sophisticated awareness of the standards landscape and shows you've done real technical homework \u2014 not just read the JD. It surfaces how the team manages technology risk when betting on emerging protocols, which is directly relevant to your execution responsibility. Your hands-on MCP SDK work at StreamIO AI means you can engage substantively with whatever he describes.\n\n---\n\n### G. Shared Context and Peer-Level Connection\n\n**Question 19**\n\n> **\"At Kaiser Permanente I spent six years building SOA platform infrastructure and Splunk-based logging services for enterprise security teams \u2014 and one of the hardest parts was getting application teams to actually adopt centralized identity services rather than rolling their own. At McKesson you built a self-service onboarding capability specifically to solve that adoption problem. Is that same adoption friction something you're still seeing internally at Okta, and is part of this PM role about solving the internal change management challenge, not just the technical one?\"**\n\n**Why this is a good question:** This builds genuine peer-level rapport by connecting your real experience to Chris's most cited McKesson achievement. It reframes you as someone who has lived the problem \u2014 not just read about it. It also surfaces whether the role has a significant change management dimension, which would be highly relevant to your background.\n\n---\n\n**Question 20**\n\n> **\"My work at Intuit involved scaling developer platform infrastructure to 675M engagements and building self-service tooling that reduced onboarding from weeks to minutes \u2014 which feels adjacent to what you described building at McKesson. In this role, is there an opportunity to apply that kind of developer experience thinking to how internal teams at Okta consume identity services, or is the scope more narrowly focused on security posture and threat response?\"**\n\n**Why this is a good question:** This connects your strongest quantitative achievement to Chris's known priorities and tests whether the role has a developer experience dimension or is purely security-focused. The answer will help you calibrate how to position your Intuit platform work throughout the conversation.\n\n---\n\n## 3. Best Conversation Starters\n\nThese are designed for the first two to three minutes \u2014 before the formal Q&A begins.\n\n### On his inventor background\n\n> *\"I noticed you hold a patent from your Dell EMC days on the CLARiiON Mirroview Persistent Fracture Log \u2014 that's a pretty rare distinction for someone who went on to lead IAM organizations. I'd love to hear how that early engineering depth has shaped the way you approach identity architecture problems today.\"*\n\n### On the McKesson IDP resiliency work\n\n> *\"Your McKesson work on IDP resiliency \u2014 deploying identity orchestration between primary and secondary IDPs to exceed five-nines of availability \u2014 is fascinating because the vendor couldn't even guarantee that independently. That's exactly the kind of 'Customer Zero' innovation this role is built around. Was that the experience that shaped how you think about the Okta on Okta mission?\"*\n\n### On your own background as a bridge\n\n> *\"I spent six years at Kaiser Permanente building enterprise SOA platform infrastructure and then moved into developer platforms at Intuit \u2014 so I've lived on both the security infrastructure side and the developer experience side of the identity problem. I'm curious how you think about balancing those two dimensions in this role.\"*\n\n---\n\n## 4. Topics to Handle Carefully\n\n### Chris's tenure at Okta\n\n**The risk:** Chris joined Okta in August 2024 \u2014 roughly a year ago. Any framing that implies the team is still immature, disorganized, or that he's \"still figuring things out\" will read as condescending. He has been building IAM organizations for 25 years and will not appreciate gap-spotting from a candidate.\n\n**Ask this instead:**\n> *\"What aspects of the Okta on Okta model have evolved the most since you arrived \u2014 and where do you see the biggest opportunity to accelerate in the next 12 months?\"*\n\nThis frames curiosity as forward-looking, not backward-auditing.\n\n---\n\n### Autonomy and guidance expectations\n\n**The risk:** The JD explicitly emphasizes \"professional maturity\" and \"operating autonomously\" rather than years of experience. Any question that implies you need more guidance, structure, or hand-holding than a Principal-level operator should need will undermine your candidacy.\n\n**Ask this instead:**\n> *\"I default to operating autonomously and bringing things to leadership when I need a blocker cleared or a strategic call made \u2014 does that match the rhythm you're looking for in this role?\"*\n\nFrame autonomy questions as **preference alignment**, not reassurance-seeking.\n\n---\n\n### Chris's departure from McKesson\n\n**The risk:** Chris's move from McKesson to Okta appears to be a deliberate, strategic step into a product-side IAM leadership role. Probing why he left or implying any instability in that transition could create unnecessary awkwardness.\n\n**Softening phrasings to reuse across the conversation:**\n- *\"From what you've seen since joining Okta...\"*\n- *\"As you've been building out the team's operating model...\"*\n- *\"Given the direction you're taking the function...\"*\n\nThese keep the conversation forward-facing and respect the intentionality of his career move.\n\n---\n\n## 5. Best Questions to Prioritize During the Call\n\nIf the conversation moves quickly and time is limited, these five questions deliver the highest signal:\n\n1. **Question 4 \u2014 30/60/90-day success definition.** You need to know the ramp expectation before you can commit to the role. This is non-negotiable.\n\n2. **Question 5 \u2014 The internal-to-external feedback loop.** The influence-without-authority dynamic is the hardest part of this job. Understanding how formalized \u2014 or broken \u2014 that loop is will tell you more about day-to-day reality than any other question.\n\n3. **Question 11 \u2014 How he handles EA readiness tension.** You will be the internal quality gate. Knowing whether Chris will back your judgment is essential for evaluating whether you can actually do the job as described.\n\n4. **Question 8 \u2014 OAuth/OIDC seams for agentic workloads.** This is the technical credibility question. Getting into a real protocol-level conversation signals that you're already operating at the level the role requires.\n\n5. **Question 17 \u2014 Human identity hardening vs. agentic infrastructure prioritization.** This reveals whether the team has a principled strategy or is reactive \u2014 and positions you as someone who thinks about portfolio tradeoffs, not just feature execution.\n\n---\n\n## 6. Suggested Call Flow\n\nUse this sequence to make the conversation feel natural rather than interrogative.\n\n**Opening \u2014 build rapport first (first 3\u20135 minutes)**\n\n> *\"Before we get into the role, I'd love to hear a bit about your journey \u2014 your McKesson IDP resiliency work is one of the things that made this role feel genuinely interesting to me. Was that the experience that shaped how you think about the Okta on Okta mission?\"*\n\n---\n\n**After he shares his background \u2014 connect your experience**\n\n> *\"That resonates a lot \u2014 at Kaiser Permanente I ran into the same adoption friction: getting application teams to use centralized identity services rather than rolling their own. I'm curious whether that's still a live challenge internally at Okta, and whether part of this PM role is about solving the change management problem, not just the technical one.\"*\n\n---\n\n**When discussing the role scope \u2014 clarify priorities**\n\n> *\"The portfolio spans a lot of surface area \u2014 DBSSO, DBSC, ITP, ISPM, O4AA, A4AA. I want to make sure I understand the sequencing logic: are all of these active in parallel right now, or is there a clear near-term mandate I should be thinking about?\"*\n\n---\n\n**When discussing the team structure \u2014 clarify execution model**\n\n> *\"I want to understand the execution model \u2014 are there dedicated engineers embedded with the PM function, or is this more of a product strategy role that works through the core engineering org? That shapes how I'd think about the first 90 days.\"*\n\n---\n\n**Near the end \u2014 open the strategic conversation**\n\n> *\"One thing I've been thinking about: is the north star for 'Okta on Okta' to be the world's most credible reference customer, or is there a broader ambition to turn internal learnings into a published framework the industry can adopt? I ask because I think those are two different roles for a Principal PM to play.\"*\n\n---\n\n**Closing \u2014 leave on a forward-looking note**\n\n> *\"This has been a genuinely exciting conversation. The intersection of session security hardening and agentic identity governance is exactly the kind of frontier problem I want to be working on. What are the next steps in the process, and is there anything you'd want me to think through or prepare before we speak again?\"*\n\n---\n\n## 7. Final Recommended Question Set\n\nIf time is short, ask these four to six questions in this order:\n\n1. What does success look like at 30, 60, and 90 days \u2014 and are internal deployment and external roadmap influence happening in parallel from day one?\n2. How formalized is the feedback loop between internal deployment findings and the core Okta/Auth0 product teams \u2014 and where does the most friction tend to occur?\n3. When a Principal PM has a strong conviction that a feature isn't ready for EA but the external team is pushing to ship \u2014 how do you expect that tension to be navigated?\n4. On the agentic identity side \u2014 are you working from a clean-slate architecture for agent authentication, or adapting existing OAuth 2.0/OIDC flows and finding where they break for non-human workloads?\n5. How does the team prioritize between hardening existing human identity security versus building net-new infrastructure for non-human agents \u2014 is there a principled framework, or is it driven by threat intelligence signals?\n6. Is the north star for 'Okta on Okta' to be the world's most credible reference customer, or is there a broader ambition to turn internal learnings into an industry framework?\n\n---\n\n## 8. Strong Closing Line\n\n> *\"I've spent the last twelve years at the intersection of platform infrastructure, developer experience, and security \u2014 from building Splunk logging services at Kaiser Permanente to scaling developer platforms to 675 million engagements at Intuit to implementing MCP-based agent orchestration at StreamIO. The 'Okta on Okta' mission \u2014 being Customer Zero for the hardest identity problems in the industry \u2014 is exactly where I want to be. I'm excited about what we could build together.\"*\n\n---\n\n## 9. Final Reminder\n\nThis conversation should demonstrate that you are already operating at the level the role requires. Specifically:\n\n- **Technical peer, not a learner.** You understand DBSSO, DBSC, AiTM, MCP, OAuth 2.0 token exchange, and agentic identity patterns at a protocol level \u2014 not just as buzzwords.\n- **Influence-first mindset.** You have a track record of shaping roadmaps and engineering priorities across matrixed organizations without direct authority \u2014 and you can speak to it concretely.\n- **Customer Zero instinct.** You have lived the enterprise adoption problem from both sides (infrastructure builder and platform PM) and know that the hardest part is usually change management, not technology.\n- **Executive presence.** You can translate deep technical architecture into business value and brief VP-level leadership with confidence \u2014 not just fluency.\n- **Genuine curiosity about Chris's thinking.** The best outcome of this conversation is that Chris leaves feeling like he just talked to someone who already thinks like the person in this seat.",
  "source_artifact_id": "art_p9kQw9wj8xg",
  "source_kind": "candidate_questions",
  "doc_type": "questions_to_ask"
}