{"id":2233750,"url":"https://alion.io/job/one-identity-senior-application-security-engineer","title":"Senior Application Security Engineer","company":{"id":9394,"name":"One Identity","domain":"oneidentity.com","url":"https://alion.io/company/one-identity","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"iCIMS","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["India"],"countries":["IN"],"hiring_countries":["IN"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":18000,"max_usd":40000,"period":"year","method":"role_seniority_country_cell","sample_n":10},"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":".NET","optional":false},{"name":"C#","optional":false},{"name":"CVE","optional":false},{"name":"FedRAMP","optional":false},{"name":"Java","optional":false},{"name":"PCI DSS","optional":false},{"name":"SBOM","optional":false},{"name":"Telegram","optional":false},{"name":"Threat Modeling","optional":false}],"status":"live","first_seen_at":"2026-10-10T23:25:25Z","employer_posted_date":"2026-10-10","last_verified_at":"2026-10-12T10:32:59Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Overview\nSenior Application Security Engineer\nOne Identity · Information Security, Attack Surface\nSenior individual contributor · India · Reports to the Director of Information Security\nWhy this role exists\nOur products are the access control layer for the companies that buy them. Identity Manager, Active Roles, Safeguard and OneLogin decide who gets into everything else a customer runs. That sets the security bar for our code higher than it sits at most software companies, and it's the reason this role works inside engineering rather than alongside it.\nMuch of what we build is deployed by customers in their own datacenters. When a defect ships, remediation moves at their upgrade cadence, not ours. That changes where the effort belongs: a design flaw caught in a threat model costs a conversation, and the same flaw caught after release costs a coordinated disclosure and a year of upgrade calls. This role is funded to move security earlier.\nWe're separating from Quest Software and building an independent security function. The team is lean and globally distributed, and this role is the security voice in the product organization. Scope comes from what you build into the development lifecycle and from what engineering chooses to adopt.\nWhat you'll do\nDesign it right\nThreat model the things that matter: authentication and session handling, privilege elevation paths, connector and integration boundaries, tenant isolation in hosted offerings, and cryptographic and secrets handling. You choose where the depth goes.\nSet security requirements early enough to shape a design instead of contesting one. Engineering teams should meet you at the architecture stage, not at the release gate.\nGive product and engineering leadership a defensible read on which risks are worth carrying, in language a release decision can be made from.\nWork in the code\nYou'll hold commit access to product repositories. A dependency bump, a patched library, a fix in the code path that produced the finding: submit it, review it, and pair with the engineer who owns that module. PRs, not tickets.\nOwn static analysis, dependency scanning, and dynamic testing across the product lines. Tune them until the signal is worth the interruption, and route findings to the team that can act on them.\nRaise the ceiling on secure coding across a large .NET and Java codebase: patterns, libraries, and reference implementations that make the safe approach the convenient one, plus the review depth to know when they're being used correctly.\nTake a position on AI-assisted development. Engineering is generating code with it, and someone needs to decide what review that code gets, where automated remediation is trusted to open a pull request, and how we verify what it changed.\nStand behind what ships\nOwn product vulnerability response end to end: intake from researchers and customers, triage across affected versions, coordinated disclosure, CVE handling, and the advisory customers actually read.\nTurn penetration test and bug bounty findings into fixes and into the systemic change that prevents the next one. Recurrence is the signal that a control is missing, not that a bug was missed.\nOwn software composition analysis and SBOM generation across the product lines, including the license and provenance data Legal and customers depend on.\nMake product security evidence available on demand. Customer questionnaires, security reviews, and certification work all draw on the same underlying facts, and they should be produced from one source.\nWhat we're looking for\nRequired\nSix or more years in software engineering or security, with at least three focused on application or product security. Equivalent depth counts.\nApplication security experience on a product that customers deploy and operate themselves, with the release and disclosure realities that come with it.\nCode-level fluency in C# and .NET, and enough range to be useful in a Java codebase. You read and write production code, not just findings.\nHands-on work with AI-assisted development or AI-enabled security tooling within the last six months, and a considered view on where it belongs in a review pipeline.\nThe three above are the bar. Everything below is depth we'd like and can build. If you meet the requirements and bring most of the rest, apply. We'd rather assess the gap ourselves than have you decide it for us.\nAlso matters: threat modeling at design time with engineering in the room; static, dynamic and composition analysis tooling and the judgment to tune it; identity and authentication protocols including OAuth, OIDC, SAML and SCIM; coordinated vulnerability disclosure and CVE handling; secure code review depth in web and API surfaces; the ability to hold a position with senior engineers and change it when they're right.\nHelpful: SBOM standards and license compliance, cryptographic review, security champions programs, PCI DSS or FedRAMP applied to a product rather than a company, prior time as a product engineer.\nWhat you should know going in\nThis role is embedded in engineering by design, with the access to prove it. You'll work across every product line, which means breadth before depth and a constant judgment call about where your attention is worth most. The work is visible to engineering leadership and it reaches customers directly through what ships and what we're able to tell them. If you want to be measured by what got fixed rather than what got filed, this is that seat.\nCompany Description\nOne Identity enables organizations of all sizes to better secure, manage, monitor, protect, and analyse information and infrastructure to help fuel innovation and drive their businesses forward.\nWith team members around the globe, we intend to continue to grow revenues and add value to customers.\nWhen you join our team, you will have the opportunity to build and develop products at a scale few others can provide.\nOur product portfolio serves a large base of customers and we are addressing the strategic imperatives for enterprise businesses.\nWorking with some of the most talented employees the industry has to offer, we provide enhanced career opportunities for team members to learn and grow in a rapidly changing environment.\nWhy work with us?\nLife at One Identity means collaborating with dedicated professionals with a passion for technology.\nWhen we see something that could be improved, we get to work inventing the solution.\nOur people demonstrate our winning culture through positive and meaningful relationships.\nWe invest in our people and offer a series of programs that enables them to pursue a career that fulfills their potential.\nOur team members’ health and wellness is our priority as well as rewarding them for their hard work.\nOne Identity is an Equal Opportunity Employer and Prohibits Discrimination and Harassment of Any Kind: One Identity is committed to the principle of equal employment opportunity for all employees and to providing employees with a work environment free of discrimination and harassment.\nAll employment decisions at One Identity are based on business needs, job requirements and individual qualifications, without regard to race, color, religion or belief, national, social or ethnic origin, sex (including pregnancy), age, physical, mental or sensory disability, HIV Status, sexual orientation, gender identity and/or expression, marital, civil union or domestic partnership status, past or present military service, family medical history or genetic information, family or parental status, or any other status protected by the laws or regulations in the locations where we operate.\nOne Identity will not tolerate discrimination or harassment based on any of these characteristics. One Identity encourages applicants of all ages.\nCome join us.\nNote: We do not use text messaging or third-party messaging apps like Telegram to communicate with applicants, so please exercise caution if you are approached in this way and only interact with people claiming to be One Identity employees if they have an email address ending in @oneidentity.com.","description_format":"text","description_chars":8083,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Identity Management","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-10T23:25:25Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":32,"reasons":["conf:2","win:early"],"computed_at":"2026-10-12T06:55:09Z"},"pay":null,"html_url":"https://alion.io/job/one-identity-senior-application-security-engineer","json_url":"https://alion.io/job/one-identity-senior-application-security-engineer.json","meta":{"generated_at":"2026-10-12T11:54:41Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":18581,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":9394},"rest":"https://alion.io/mcp/rest/get_company?id=9394"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fone-identity-senior-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fone-identity-senior-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fone-identity-senior-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/one-identity-senior-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fone-identity-senior-application-security-engineer"}]}