Staff Product Security Engineer, Offensive Security (AI)

Location: Dublin, Ireland

Annual salary: €90,000–€123,200 EUR for candidates located in Ireland.

Company

Okta builds identity and access infrastructure that helps organizations securely use applications, AI, and other technologies.

What you will do

• Identify, plan, and exploit complex security gaps across application, cloud, network, identity, and AI/LLM layers.
• Conduct targeted security assessments and penetration tests, document exploit recreation, and provide architectural remediation guidance.
• Assess AI/LLM-integrated features and agent-based workflows, develop novel attack techniques, and evaluate defensive controls.
• Design, build, and maintain offensive automation frameworks, including fuzzers, scanners, and pipeline-integrated validation tools.
• Act as a security subject-matter expert across internal teams and represent Okta in relevant internal and external forums.
• Triage internal vulnerability tickets and external bug bounty submissions periodically.

Requirements

• Staff-level technical experience in offensive security.
• At least 5 years of preferred experience conducting penetration tests of web applications, related infrastructure, and networks.
• Extensive experience testing identity and access management platforms, multi-tenant SaaS architectures, or authentication and authorization systems.
• Strong understanding of application security principles, common vulnerabilities, backend and middleware testing, and network penetration testing methodologies.
• Experience testing authentication protocols including SAML, OAuth 2.0, and OIDC and their associated attack surfaces.
• Experience assessing AI/LLM security risks and developing, or strong interest in developing, offensive techniques against AI-integrated systems, including model-pipeline supply-chain risks and guardrail evaluation.
• Track record of building and shipping maintainable offensive security tooling beyond ad-hoc scripts.
• Experience operating within and securing cloud environments; GCP experience is required.
• Understanding of cloud security architecture and common attack vectors; familiarity with AWS or Azure is welcomed.
• Experience with infrastructure tooling such as Kubernetes, Terraform, Chef, and ArgoCD, plus Infrastructure as Code for building and testing environments.
• Thorough familiarity with Linux and macOS security features, command-line tools, and common attack surfaces.
• Familiarity with threat modeling concepts and frameworks and a solid understanding of modern cryptographic principles and their application.
• Ability to think strategically, develop comprehensive attack scenarios, and communicate vulnerabilities and remediation strategies clearly to technical and non-technical audiences.
• Proactive approach to learning about emerging threats and developing new security techniques.
• Experience or interest in mentoring and sharing knowledge with team members.

Culture & Benefits

• Equity where applicable, bonus, comprehensive healthcare coverage, financial benefits, paid time off, and parental leave according to applicable plans and policies.
• Support for publishing impactful security research through papers, blog posts, and industry conference presentations.
• Global community spanning more than 20 offices worldwide.
• Immersive in-person onboarding designed to connect new hires with the mission and team.
• Programs focused on well-being, social impact, talent development, connection, and community.