Staff Product Security Engineer, Offensive Security Team

The Offensive Security Team, part of Product Security, actively assesses the security of Okta's products, services, and infrastructure, and we are seeking a highly technical and driven staff-level engineer to contribute to this effort. This role demands more than running vulnerability scans. Excelling here requires a thorough understanding of offensive security testing and a strong drive to identify and leverage security weaknesses. Above all, the most critical attribute of this role is an innate ability to think and operate as a sophisticated adversary. This skill is key to solving security challenges, drawing on deep technical expertise and creativity.

The ideal candidate will possess demonstrable expertise in the following areas:

• Application & Network Security: Solid understanding of application security principles, common vulnerabilities, backend/middleware testing, and network penetration testing methodologies.

Identity Security: Experience testing identity and access management systems, including authentication protocols such as SAML, OAuth 2.0, and OIDC, and their associated attack surfaces.

• AI/LLM Security: Experience assessing the security of systems that integrate large language models and AI-driven automation, including supply-chain risks in model pipelines. Ability to develop novel attack techniques against AI-augmented products and evaluate guardrail effectiveness.
• Automation & Offensive Tooling: A track record of building maintainable, repeatable Offensive Security tools that accelerate security assessments, automate vulnerability discovery, and integrate with existing workflows.
• Operating Systems: Thorough familiarity with Linux and macOS operating systems, including their security features, command-line tools, and common attack surfaces.
• Cloud Security: Understanding of cloud security architecture and common attack vectors. Experience with GCP is required, and depth in AWS or Azure is also welcomed.
• Infrastructure & DevOps: Experience with infrastructure tooling such as Kubernetes, Terraform, Chef, and ArgoCD, and an understanding of how they shape the operational environment.
• Communication: Excellent written and verbal communication skills with the ability to clearly and concisely articulate vulnerabilities and remediation strategies to technical and non-technical audiences. 

We actively encourage and support the external publication of impactful security research and findings through papers, blog posts, and presentations at industry conferences.

What You Will Do

• Apply an attacker mindset to identify, plan, and exploit complex security gaps across app, cloud, and network layers.
• Conduct targeted security assessments and pentests; deliver actionable findings, detailed exploit recreation, and architectural remediation guidance.
• Assess the security of AI/LLM-integrated features and agent-based workflows, develop novel attack techniques, and evaluate defensive controls.
• Design, build, and maintain offensive automation frameworks that scale security coverage from custom fuzzers and scanners to pipeline-integrated validation tools.
• Act as a security SME across internal teams and represent Okta in internal and external forums when appropriate.
• Periodically triage internal vulnerability tickets and external bug bounty submissions.
  
  

What You Bring

• Demonstrable experience in penetration testing web applications, related infrastructure, and networks (5+ years preferred)
• Extensive experience testing identity/IAM platforms, multi-tenant SaaS architectures, or authentication/authorization systems
• Familiarity with AI/LLM security risks and experience or strong interest in developing offensive techniques against AI-integrated systems
• Track record of building and shipping offensive security tooling beyond ad-hoc scripts
• Experience in operating within and securing cloud environments (GCP required)
• Familiarity with Threat Modeling concepts and frameworks
• Experience with Infrastructure as Code (e.g., Terraform) for building and testing environments
• Solid understanding of modern cryptographic principles and their application
• Ability to think strategically and develop comprehensive attack scenarios
• Effective communication skills for conveying technical security findings to various audiences
• A proactive approach to learning about emerging threats and developing new security techniques
• Experience or interest in mentoring and sharing knowledge with team members

# P26091_3581972