Staff Security Engineer - Vulnerability Management US Public Sector

<div class="content-intro"><p><span style="color: #000000;"><strong>Get to know Okta<br><br></strong></span>Okta is The World’s Identity Company. We free everyone to safely use any technology, anywhere, on any device or app. Our flexible and neutral products, Okta Platform and Auth0 Platform, provide secure access, authentication, and automation, placing identity at the core of business security and growth.<br><br>At Okta, we celebrate a variety of perspectives and experiences. We are not looking for someone who checks every single box - we’re looking for lifelong learners and people who can make us better with their unique experiences. <br><br>Join our team! We’re building a world where Identity belongs to you.</p></div><div class="SingleJob-content"> <p><strong>Staff Security Engineer - Vulnerability Management US Public Sector</strong></p> <p>The Okta Security team’s mission is to strengthen Okta’s position as the leading Identity-as-a-Service solutions through identifying and resolving risks to the employees, product, and most importantly, our customers. With the ever-increasing pace of cloud application adoption, companies are struggling to find ways to accurately assess risk and act at the speed of their business. </p> <p>The Staff Security Engineer for Public Sector is a key member of the Okta Security team and an essential collaborator with our broader Engineering organization playing a key part in executing the Vulnerability Management Program’s strategy. The Vulnerability Management Program is a crucial pillar of the security organizations’ imperative to reduce the threats to Okta’s infrastructure and applications. You’ll be an integral part of building and sustaining strong and effective relationships across Okta with our Engineering, Product and Business Technology counterparts.</p> <p><strong> </strong></p> <p>What You'll Do</p> <ul> <li>Own the full lifecycle operations of Asset and Vulnerability Management scanning and reporting infrastructure, including designing new cloud based and on-prem deployments as required.</li> <li>Assess new and existing scan technologies to determine potential business value.</li> <li>Monitor and respond to security inquiries, requests, and incidents, understanding the technical details of the published vulnerabilities as well as their real risk. Effectively communicate the perceived and real vulnerability impact given the infrastructure context.</li> <li>Contribute to the definition and execution of internal processes that allow for accelerated remediation of critical vulnerabilities and zero-days.</li> <li>Support audit, governance, risk and compliance teams in scanning and reporting on various regulatory compliance and industry best practices including PCI, ISO 27001/27017/27018 , NIST SP 800-53 and SOC 2.</li> <li>Assist Okta’s Public Sector compliance team in their preparation and maintenance of POAMs (Plan of Action Milestones) and Continuous Monitoring (ConMon) processes.</li> <li>Track and manage weaknesses or gaps in vulnerability related security controls, outlining tasks, required resources, milestones, and scheduled completion dates to achieve compliance with standards like NIST 800-171 and CMMC.</li> <li>Participate in other special projects or strategic initiatives at the direction of the Security team.</li> </ul> <p><strong> </strong></p> <p>Your Background</p> <ul> <li>Must have ability to work independently on end to end delivery of infrastructure deployment and troubleshooting run time issues.</li> <li>Proven experience in architecting, deploying, and operating self-hosted vulnerability management and cloud workload security solutions in AWS for regulated or restricted environments.</li> <li>Must have proficiency in AWS core services such as host OS and container deployment, S3, DynamoDB, API Gateway, and others.</li> <li>Experience working with AWS Lambda or similar serverless computing environments for automating vulnerability management scanning and reporting tas ... (truncated, view full listing at source)