Senior Application Security Engineer

Senior Application Security Engineer

Location: Remote, USA
Employment Type: Full-Time
Compensation: $ - $ (Range applies to US candidates only) + Benefits/Variable Comp/Equity - Range may vary based on experience.
Benefits Offered: Vision, Medical, Life, Dental, 401K

The Senior Application Security Engineer joins the Information Security team and plays a key role in securing the One Stream platform throughout the software development lifecycle. This role is responsible for defining and enforcing secure coding and development practices, performing application security testing to identify risks and vulnerabilities before release and in production, and reviewing the output of application security tools to provide clear remediation guidance across the organization.

In addition, the Senior Application Security Engineer partners with engineering teams on the planning and architecture of new features, contributes to platform security design, and leads or supports the development of custom security tools and scanning capabilities. The ideal candidate brings a strong foundation in secure development and programming practices, hands‑on experience with C# and .NET, and a passion for protecting customers.

This role requires effective communication across technical and non‑technical audiences and may involve developing proof‑of‑concept exploits to validate vulnerabilities and assess real‑world risk.

• Perform manual and automated application security testing to identify vulnerabilities across the One Stream platform.
• Conduct code analysis to assess and ensure the security of application code.
• Evaluate the software development lifecycle (SDLC) to identify opportunities to strengthen application and supply‑chain security.
• Partner with Development and Engineering teams to embed security into One Stream services and workflows.
• Collaborate with members of the Security team to identify attack patterns and indicators of compromise.
• Design, develop, and maintain custom security testing tools to support internal testing efforts.
• Define, document, and enforce secure development policies, standards, and procedures.
• Provide mentorship and technical guidance to junior members of the Security team to support growth and knowledge sharing.
• Document, communicate, and report security findings and risks identified during testing activities.
• Perform penetration testing against One Stream assets to validate application and infrastructure security.
• Conduct security architecture and design reviews to ensure secure‑by‑design implementations.
• Provide secure design and secure coding guidance to engineering teams throughout the development lifecycle.

• One of the following combinations of education and experience:
  • Bachelor's degree in Computer Science, Engineering, or a related field with 8+ years of experience in application security testing, penetration testing, or software development;
  • Master's degree in Computer Science, Engineering, or a related field with 3+ years of experience in application security testing, penetration testing, or software development;
  • Associate degree in Computer Science, Engineering, or a related field with 12+ years of experience in application security testing, penetration testing, or software development.
• 3+ years of hands‑on experience conducting threat modeling for applications and systems and translating findings into actionable remediation guidance.

• Experience writing and reviewing C# and .NET code, including secure coding and code review practices.
• Hands‑on experience performing penetration testing of web applications.
• Experience decompiling and reverse engineering .NET libraries.
• Broad experience across IT security and infrastructure, security risk management, and compliance frameworks such as SOC 2 and FedRAMP, including security policies, procedures, testing, auditing, and internal audit.
• Industry‑recognized offensive security or penetration testing certifications, such as:
  • Offensive Security Certified Professional (OSCP)
  • GIAC Exploit Researcher and Advanced Penetration Tester (GXPN)
  • GIAC Penetration Tester (GPEN)
  • Ot…