Staff Detection & Response Engineer

Okta, Inc.; Colorado; Remote; USD 180,000 - 270,000; Full time

Job summary

Okta is seeking a Staff Engineer in Detection and Response to enhance security operations within their Cyber Defense team. This role focuses on developing detection mechanisms, incident response automation, and mentoring engineers to foster a strong security posture. The ideal candidate possesses robust leadership and technical skills, complemented by an equivalent background in a complex technical environment.

Benefits

Health, dental and vision insurance

401(k)

Flexible spending account

Paid leave, including PTO and parental leave

Qualifications

• 5+ years in Detection & Response experience required.
• Experience in incident command during cybersecurity incidents.
• Background in developing detection automation.

Responsibilities

• Develop security detections across infrastructure and applications.
• Investigate and respond to security incidents.
• Build automation for detection and response workflows.

Skills

Leadership

Communication

Technical expertise

Education

Equivalent work experience

Job description

San Francisco, CA; Bellevue, WA; Chicago, IL; New York, NY; Washington, DC

Get to know Okta

Okta is The World’s Identity Company. We free everyone to safely use any technology—anywhere, on any device or app. Our Workforce and Customer Identity Clouds enable secure yet flexible access, authentication, and automation that transforms how people move through the digital world, putting Identity at the heart of business security and growth.

At Okta, we celebrate a variety of perspectives and experiences. We are not looking for someone who checks every single box - we’re looking for lifelong learners and people who can make us better with their unique experiences.

Join our team! We’re building a world where Identity belongs to you.

The Role

Okta is seeking an experienced Staff Engineer, Detection and Response to take on a key role as a senior technical expert within Okta’s Cyber Defense team, reporting to the Senior Manager of Defensive Cyber Operations (Americas). You will work closely with engineers and cross-functional teams to improve security operations, develop threat detection mechanisms, and drive incident response automation. You will serve as a technical leader, providing hands-on expertise and mentoring for other engineers within the team.

Core Responsibilities

Detection Engineering

• Develop and refine security detections across Okta’s infrastructure and applications ensuring optimal coverage across the organization.
• Create high-fidelity alerts that balance security visibility with operational efficiency.
• Work with detection & response engineers to tune detections, reduce false positives, and enhance response workflows.
• Investigate and respond to security incidents, working to quickly contain and remediate threats.
• Take part in the DCO watch roster triaging alerts escalated via automated processes, internal reports, and third-party notifications.
• Perform forensic analysis of security events, logs, and endpoints to determine root causes.
• Develop and improve response playbooks and automation to streamline incident handling.

Security Automation & Engineering

• Build automation to improve detection and response workflows, reducing manual effort.
• Integrate security tools and APIs for enhanced threat detection and data correlation.
• Develop custom scripts and tooling to improve team efficiency and incident response capabilities.
• Work closely with security engineers, threat intelligence teams, and platform engineering teams to ensure a holistic security approach.
• Mentor and coach other engineers, providing technical guidance and support.
• Stay up to date with the latest attack techniques and security trends to continuously improve Okta’s defenses.

What does it take?

You’re a team player. You have great communications skills and a thirst for knowledge. You’re curious about systems and how they interact, knowing that to properly defend a system you must first understand how it works. You enjoy automating tasks and if you can’t find a tool for the job you create one. You’re calm under pressure and have a good internal compass for taking calculated risks.

If you don’t have a degree, you have equivalent experience that’s given you the foundational knowledge to understand complex computing environments.

You’re a leader. People want to work with you. You know what it takes to build a world-class defensive cyber capability and you’re passionate about helping make ours stronger. Your experience probably includes:

• Leading, or contributing to, technology focused teams large or small.
• Mentoring staff and providing development opportunities to build high performing teams.
• Operating as, or providing support to, the incident commander or technical lead during cyber security incidents.
• Developing advanced detection capabilities, working with detection-as-code, and automating the triage and response of alerts they generate.

Ideally you also have experience in several of the following areas:

• Researching the tactics, techniques and procedures of sophisticated adversaries and hunting for evidence of them within an enterprise environment.
• Developing detection and response validation techniques and automating tests to enable continuous assurance of defensive cyber capabilities.
• Analysing critical systems to understand both how to break them and defend them against attack.
• Working collaboratively within product and/or enterprise project teams, assisting to deliver large and complex technology solutions.

This position requires the ability to access federal environments and/or have access to protected federal data. As a condition of employment for this position, the successful candidate must be able to submit documentation establishing U.S. Person status (e.g. a U.S. Citizen, National, Lawful Permanent Resident, Refugee, or Asylee. 22 CFR 120.15) upon hire.

#LI-REMOTE

#LI-SH1

The annual base salary range for this position for candidates located in the San Francisco Bay area is between:

Get to know Okta

Okta is The World’s Identity Company. We free everyone to safely use any technology—anywhere, on any device or app. Our Workforce and Customer Identity Clouds enable secure yet flexible access, authentication, and automation that transforms how people move through the digital world, putting Identity at the heart of business security and growth.

At Okta, we celebrate a variety of perspectives and experiences. We are not looking for someone who checks every single box - we’re looking for lifelong learners and people who can make us better with their unique experiences.

Join our team! We’re building a world where Identity belongs to you.

The Role

Okta is seeking an experienced Staff Engineer, Detection and Response to take on a key role as a senior technical expert within Okta’s Cyber Defense team, reporting to the Senior Manager of Defensive Cyber Operations (Americas). You will work closely with engineers and cross-functional teams to improve security operations, develop threat detection mechanisms, and drive incident response automation. You will serve as a technical leader, providing hands-on expertise and mentoring for other engineers within the team.

Core Responsibilities

Detection Engineering

• Develop and refine security detections across Okta’s infrastructure and applications ensuring optimal coverage across the organization.
• Create high-fidelity alerts that balance security visibility with operational efficiency.
• Work with detection & response engineers to tune detections, reduce false positives, and enhance response workflows.

Incident Response & Forensics

• Investigate and respond to security incidents, working to quickly contain and remediate threats.
• Take part in the DCO watch roster triaging alerts escalated via automated processes, internal reports, and third-party notifications.
• Perform forensic analysis of security events, logs, and endpoints to determine root causes.
• Develop and improve response playbooks and automation to streamline incident handling.

Security Automation & Engineering

• Build automation to improve detection and response workflows, reducing manual effort.
• Integrate security tools and APIs for enhanced threat detection and data correlation.
• Develop custom scripts and tooling to improve team efficiency and incident response capabilities.

Collaboration & Knowledge Sharing

• Work closely with security engineers, threat intelligence teams, and platform engineering teams to ensure a holistic security approach.
• Mentor and coach other engineers, providing technical guidance and support.
• Stay up to date with the latest attack techniques and security trends to continuously improve Okta’s defenses.

What does it take?

You’re a team player. You have great communications skills and a thirst for knowledge. You’re curious about systems and how they interact, knowing that to properly defend a system you must first understand how it works. You enjoy automating tasks and if you can’t find a tool for the job you create one. You’re calm under pressure and have a good internal compass for taking calculated risks.

If you don’t have a degree, you have equivalent experience that’s given you the foundational knowledge to understand complex computing environments.

You’re a leader. People want to work with you. You know what it takes to build a world-class defensive cyber capability and you’re passionate about helping make ours stronger. Your experience probably includes:

• Leading, or contributing to, technology focused teams large or small.
• Mentoring staff and providing development opportunities to build high performing teams.
• Operating as, or providing support to, the incident commander or technical lead during cyber security incidents.
• Developing advanced detection capabilities, working with detection-as-code, and automating the triage and response of alerts they generate.

Ideally you also have experience in several of the following areas:

• Researching the tactics, techniques and procedures of sophisticated adversaries and hunting for evidence of them within an enterprise environment.
• Developing detection and response validation techniques and automating tests to enable continuous assurance of defensive cyber capabilities.
• Analysing critical systems to understand both how to break them and defend them against attack.
• Working collaboratively within product and/or enterprise project teams, assisting to deliver large and complex technology solutions.

This position requires the ability to access federal environments and/or have access to protected federal data. As a condition of employment for this position, the successful candidate must be able to submit documentation establishing U.S. Person status (e.g. a U.S. Citizen, National, Lawful Permanent Resident, Refugee, or Asylee. 22 CFR 120.15) upon hire.

#LI-REMOTE

#LI-SH1

The annual base salary range for this position for candidates located in the San Francisco Bay area is between: $180,000 — $270,000 USD

Below is the annual base salary range for candidates located in California, Colorado, New York and Washington. Your actual base salary will depend on factors such as your skills, qualifications, experience, and work location. In addition, Okta offers equity (where applicable), bonus, and benefits, including health, dental and vision insurance, 401(k), flexible spending account, and paid leave (including PTO and parental leave) in accordance with our applicable plans and policies. To learn more about our Total Rewards program please visit: https://rewards.okta.com/us .

The annual base salary range for this position for candidates located in California (excluding San Francisco Bay Area), Colorado, New York, and Washington is between: $161,000 — $241,000 USD

What you can look forward to as a Full-Time Okta employee!

• Amazing Benefits
• Making Social Impact
• Developing Talent and Fostering Connection + Community at Okta

Okta cultivates a dynamic work environment, providing the best tools, technology and benefits to empower our employees to work productively in a setting that best and uniquely suits their needs. Each organization is unique in the degree of flexibility and mobility in which they work so that all employees are enabled to be their most creative and successful versions of themselves, regardless of where they live. Find your place at Okta today! https://www.okta.com/company/careers/ .

Some roles may require travel to one of our office locations for in-person onboarding.

Okta is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, ancestry, marital status, age, physical or mental disability, or status as a protected veteran. We also consider for employment qualified applicants with arrest and convictions records, consistent with applicable laws.

If reasonable accommodation is needed to complete any part of the job application, interview process, or onboarding please use this Form to request an accommodation.

Okta is committed to complying with applicable data privacy and security laws and regulations. For more information, please see our Privacy Policy at https://www.okta.com/privacy-policy/ .

U.S. Equal Opportunity Employment Information
Read more

The foundation for secure connections between people and technology

Okta is the leading independent provider of identity for the enterprise. The Okta Identity Cloud enables organizations to securely connect the right people to the right technologies at the right time. With over 7,000 pre-built integrations to applications and infrastructure providers, Okta customers can easily and securely use the best technologies for their business. More than 19,300 organizations, including JetBlue, Nordstrom, Slack, T-Mobile, Takeda, Teach for America, and Twilio, trust Okta to help protect the identities of their workforces and customers.

Follow Okta

First Name

Last Name

Email

Phone

Resume

Upload PDF

Paste

Upload Resume/CV (PDF must be less than 8 MB )

Upload PDF

Paste

Upload Cover Letter (PDF must be less than 8 MB )

LinkedIn Profile

Website

Are you legally authorized to work in the country you reside?

Will you now or in the future require Visa Sponsorship?

Do you have any outside business activity(ies) (advisory, consulting, or board roles, or side businesses) that you would continue engaging in or plan to engage in if you joined Okta in this role?

If yes, please describe:

To the best of your knowledge, do you have any family members / relatives or personal relationships at Okta or at any suppliers, partners, or vendors that have a business relationship with Okta?(For purposes of this question, a “family member / relative or personal relationship” is defined as close personal friends (including sexual and/or romantic relationships), close relatives (spouse, partner, children, cousins, aunts, uncles, nieces, nephews, grandparents or grandchildren), someone who lives in your household, or anyone else with whom you have a close enough personal relationship or connection that it could improperly bias your conduct or decision making or be perceived to be capable of impacting your conduct or decision making.

If yes, please identify name of person / vendor and describe relationship / association:

Have you worked for Okta in the past?

I acknowledge and agree to the processing of my personal data in accordance with Okta's Privacy Policy.

I would like to be considered for future positions at Okta.

Yes

Are you located in San Francisco, Seattle/Bellevue, New York City, Chicago, or Washington DC?

Please confirm your city, state and timezone. All 3.

Do you have 5+ years of Detection & Response?

Do you have 3-4+ years of SQL experience?

Are you a US person? This position requires the ability to access federal environments and/or have access to protected federal data. As a condition of employment for this position, the successful candidate must be able to submit documentation establishing U.S. Person status (e.g. a U.S. Citizen, National, Lawful Permanent Resident, Refugee, or Asylee. 22 CFR 120.15) upon hire.