Staff Detection & Response Engineer (Federal)

Okta is seeking an experienced Staff Engineer, Detection and Response to take on a key role as a senior technical expert within Okta's Cyber Defense team, reporting to the Senior Manager of Defensive Cyber Operations (Americas). You will work closely with engineers and cross-functional teams to improve security operations, develop threat detection mechanisms, and drive incident response automation. You will serve as a technical leader, providing hands-on expertise and mentoring for other engineers within the team.

• Develop and refine security detections across Okta's infrastructure and applications ensuring optimal coverage across the organization.
• Create high-fidelity alerts that balance security visibility with operational efficiency.
• Work with detection & response engineers to tune detections, reduce false positives, and enhance response workflows.

• Investigate and respond to security incidents, working to quickly contain and remediate threats.
• Take part in the DCO watch roster triaging alerts escalated via automated processes, internal reports, and third-party notifications.
• Perform forensic analysis of security events, logs, and endpoints to determine root causes.
• Develop and improve response playbooks and automation to streamline incident handling.

• Build automation to improve detection and response workflows, reducing manual effort.
• Integrate security tools and APIs for enhanced threat detection and data correlation.
• Develop custom scripts and tooling to improve team efficiency and incident response capabilities.

• Work closely with security engineers, threat intelligence teams, and platform engineering teams to ensure a holistic security approach.
• Mentor and coach other engineers, providing technical guidance and support.
• Stay up to date with the latest attack techniques and security trends to continuously improve Okta's defenses.

You're a team player. You have great communications skills and a thirst for knowledge. You're curious about systems and how they interact, knowing that to properly defend a system you must first understand how it works. You enjoy automating tasks and if you can't find a tool for the job you create one. You're calm under pressure and have a good internal compass for taking calculated risks.

If you don't have a degree, you have equivalent experience that's given you the foundational knowledge to understand complex computing environments.

You're a leader. People want to work with you. You know what it takes to build a world-class defensive cyber capability and you're passionate about helping make ours stronger. Your experience probably includes:

• Leading, or contributing to, technology focused teams large or small.
• Mentoring staff and providing development opportunities to build high performing teams.
• Operating as, or providing support to, the incident commander or technical lead during cyber security incidents.
• Developing advanced detection capabilities, working with detection-as-code, and automating the triage and response of alerts they generate.

Ideally you also have experience in several of the following areas:

• Researching the tactics, techniques and procedures of sophisticated adversaries and hunting for evidence of them within an enterprise environment.
• Developing detection and response validation techniques and automating tests to enable continuous assurance of defensive cyber capabilities.
• Analysing critical systems to understand both how to break them and defend them against attack.
• Working collaboratively within product and/or enterprise project teams, assisting to deliver large and complex technology solutions.

This position requires the ability to access federal environments and/or have access to protected federal data. As a condition of employment for this position, the successful candidate must be able to submit documentation establishing U.S. Person status (e.g. a U.S. Citizen, National, Lawful Permanent Resident, Refugee, or Asylee. 22 CFR 120.15) upon hire.

#LI-REMOTE

#LI-SH1