SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: EUR 90,000 - 123,200 / annual
Okta's Offensive Security Team, part of Product Security, is seeking a highly technical Staff-level engineer to actively assess the security of Okta's products, services, and infrastructure. This role goes beyond running vulnerability scans—it requires deep expertise in offensive security testing and the ability to think and operate as a sophisticated adversary to identify and exploit security weaknesses.
You will apply an attacker mindset to identify, plan, and exploit complex security gaps across application, cloud, and network layers. Key responsibilities include conducting targeted security assessments and penetration tests with actionable findings and detailed exploit recreation; assessing the security of AI/LLM-integrated features and agent-based workflows while developing novel attack techniques; designing, building, and maintaining offensive automation frameworks that scale security coverage from custom fuzzers and scanners to pipeline-integrated validation tools; acting as a security subject-matter expert across internal teams; and periodically triaging internal vulnerability tickets and external bug bounty submissions.
Okta actively encourages and supports external publication of impactful security research through papers, blog posts, and presentations at industry conferences.
REQUIREMENTS:
- Demonstrable experience in penetration testing web applications, related infrastructure, and networks (5+ years preferred)
- Extensive experience testing identity/IAM platforms, multi-tenant SaaS architectures, or authentication/authorization systems
- Solid understanding of application security principles, common vulnerabilities, backend/middleware testing, and network penetration testing methodologies
- Experience testing identity and access management systems, including authentication protocols such as SAML, OAuth 2.0, and OIDC, and their associated attack surfaces
- Familiarity with AI/LLM security risks and experience or strong interest in developing offensive techniques against AI-integrated systems; ability to assess supply-chain risks in model pipelines and evaluate guardrail effectiveness
- Track record of building and shipping offensive security tooling beyond ad-hoc scripts; experience with maintainable, repeatable offensive security tools that accelerate assessments and automate vulnerability discovery
- Experience in operating within and securing cloud environments (GCP required; depth in AWS or Azure welcomed)
- Thorough familiarity with Linux and macOS operating systems, including their security features, command-line tools, and common attack surfaces
- Experience with infrastructure tooling such as Kubernetes, Terraform, Chef, and ArgoCD
- Familiarity with Threat Modeling concepts and frameworks
- Experience with Infrastructure as Code (e.g., Terraform) for building and testing environments
- Solid understanding of modern cryptographic principles and their application
- Ability to think strategically and develop comprehensive attack scenarios
- Excellent written and verbal communication skills with the ability to clearly articulate vulnerabilities and remediation strategies to technical and non-technical audiences
- Proactive approach to learning about emerging threats and developing new security techniques
- Experience or interest in mentoring and sharing knowledge with team members
