Python Job: Engineer

Information Security is a top business imperative at Okta. In addition to driving security in our Corporate environment and Okta service, the Security team is deeply entrenched in the Okta business. As such, we contribute to product roadmaps, branding, research and other strategic aspects of our operations. We work across multiple functions, business partners and the research community. We are an engineering-focused team that seeks to stay on the cutting edge of security technology and the threat landscape.

The Defensive Cyber Operations (DCO) team is seeking a Detection and Response Engineer to contribute to Okta's detection and response programs responsible for defending the Okta platform, infrastructure and corporate environment.

The Role

You will operate as part of the DCO Detection Automation & Response Engineering team, building and maintaining the detection and response capabilities to enable Okta's intel-driven approach to defensive cyber operations. Core responsibilities include:

• Close gaps in Okta's detection and response coverage identified by senior team members
• Orchestrate and automate the enrichment, triage and response steps required to respond to security related alerts
• Take part in the DCO watch roster triaging alerts escalated via automated processes, internal reports, and third-party notifications
• Contribute to the investigation, remediation and reporting of cyber security incidents
• Address needs for tools and data that will enable the continuous improvement of detection and response capabilities

What does it take?

You're a team player. You have great communications skills and a thirst for knowledge. You're curious about systems and how they interact, knowing that to properly defend a system you must first understand how it works. You enjoy automating tasks and if you can't find a tool for the job you create one. You're calm under pressure and have a good internal compass for taking calculated risks. You have a growth mindset, and are eager to learn the skills you will need to advance in your career. You may have work or internship experience which includes:

• Contributing to technology focused teams
• Providing support to the incident commander or technical lead during cyber security incidents
• Developing detection capabilities and automating the triage and response of alerts they generate

Ideally you also have professional experience in, or academic exposure to, some of the following areas:

• Researching the tactics, techniques and procedures of sophisticated adversaries and hunting for evidence of them
• Developing detection and response validation techniques and automating tests to enable continuous assurance of defensive cyber capabilities.
• Analysing critical systems to understand both how to break them and defend them against attack.

Past experience using (or learning about) any of these tools and technologies is a plus. Willingness to learn them on the job is a must:

• Python
• AWS
• Splunk
• SQL
• Terraform
• Windows, Mac and Linux skills