Okta’s Defensive Cyber Operations (DCO) organization is seeking an offensive security minded individual to join the Adversarial Engineering team and contribute to the continued buildout of the program. As part of the DCO team, Adversarial Engineering is tasked to improve Okta and our customer’s security posture by emulating attacker techniques to identify areas of improvement for detection and response. This extends beyond traditional “purple teaming” of end-points or networks to also look at Okta as a product and SaaS applications used internally.
An ideal candidate will have experience in the offensive or defensive cybersecurity domains but both are not required. They would also have the ability to develop and extend tools used to emulate threats. Red team or detection engineering experience in AWS, macOS and containerized environments is desirable.
What this position is not.
- This is not a “red team”, full scope operational role. Live engagements are coordinated with the defensive teams up front with full knowledge. Many initiatives are run in controlled lab environments.
- This is not a penetration testing role. While vulnerabilities may be found, the purpose is not the identification and exploitation of vulnerabilities. Value is provided in the analysis of how an attacker may leverage systems.
- This is not a SOC or detection engineering role. The hired individual may provide support during incidents or develop detection logic, but works separately from the daily workflows of the Detection and Response Engineering team.
Job Duties and Responsibilities:
- Research adversary methodology with an end-goal of replication.
- Develop automated testing using breach and assessment tools to validate Okta’s defensive capabilities.
- Scope and execute emulations of adversary capabilities in environments that include: Windows, macOS, Linux, AWS, and containerization such as Docker and ECS.
- Scope and execute emulations against Okta’s products and the abuse of business applications including SaaS-based.
- Provide analysis of emulated activity in instrumented environments to identify gaps and provide guidance on detection or response improvements.
