{"id":2990,"url":"https://alion.io/job/oneleet-application-security-engineer","title":"Application Security Engineer","company":{"id":1055,"name":"Oneleet","domain":"oneleet.com","url":"https://alion.io/company/oneleet","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":92,"open_postings":8,"ghost_share":0,"stale_share":0.125,"repost_share":0,"time_to_fill_p50_days":108,"computed_at":"2026-10-16T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":160000,"max":220000,"currency":"USD","period":"year","gross":null,"usd_annual":220000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CVE","optional":false},{"name":"CWE","optional":false},{"name":"Function Calling","optional":false},{"name":"Go","optional":false},{"name":"ISO 27001","optional":false},{"name":"LLM","optional":false},{"name":"Python","optional":false},{"name":"SOC 2","optional":false},{"name":"Tool Use","optional":false},{"name":"TypeScript","optional":false}],"status":"live","first_seen_at":"2026-05-28T20:52:13Z","employer_posted_date":"2026-05-28","last_verified_at":"2026-10-17T00:54:35Z","board_verified":true,"closed_at":null,"days_open":141,"trust":{"level":"ok","repost_count":0,"flags":[],"days_open":140},"description":"About Oneleet\nOneleet is one of the fastest-growing security and compliance platforms in history. We are on a mission to change the compliance and security industry by making cybersecurity and compliance effective, easy, and painless. We provide a platform that helps companies build, manage, and monitor their cybersecurity programs and achieve compliance standards such as SOC 2 and ISO 27001 efficiently, without cutting corners.\nHaving just raised a $33 million Series A, we are rapidly growing in customers and employees. Our team has decades of experience in security and compliance. Join our team of opinionated rebels and help us build a category-defining company reshaping the broken and fragmented compliance and cybersecurity industry.\nWho we’re looking for:\nWe value passionate self-starters with a growth mindset and a bias for action and personal accountability. If you love solving hard problems, thrive in ambiguity, and want to make a real impact, you’ll fit right in.\nWe’re especially drawn to:\nRebels with a cause - frustrated with the status quo and eager to disrupt it.\n\nOpinionated (but not obstinate) builders - decisive yet collaborative, who help us move fast.\n\nClear communicators - who own their ideas and follow through.\n\nOur mission is simple: make effective cybersecurity painless. We believe cybersecurity should empower, not burden. This belief unites our team and drives every decision we make.\nIf you’re ready to challenge the status quo and help shape the future of cybersecurity, we’d love to meet you.\nAs an Application Security Engineer at Oneleet, you'll bring security depth to our product engineering teams as we expand our cybersecurity platform. You'll own the security judgment layer that sits between raw tooling output and what our customers actually see - deciding what to surface, what to suppress, and how to make findings genuinely useful rather than noisy.\nThis is a hands-on, security-first engineering role at a Series A startup. You'll work closely with backend and fullstack engineers on how findings are stored, enriched, and presented, and you'll partner with product and design on what to build next. You'll be the security voice in product and engineering decisions, and you'll be empowered to push back when security judgment requires it.\nYou'll work directly with customers - security teams using the platform day-to-day - to understand what they actually need, and iterate quickly based on their feedback.\nKey Responsibilities:\nOwn the integration, configuration, and output quality of security tooling that powers our platform\n\nTune outputs to maximize signal and minimize noise - decide what to surface, what to suppress, and what to enrich\n\nDesign rules, severity scoring, and triage flows that make findings actionable rather than overwhelming\n\nBuild the security judgment layer on top of underlying tooling - context-aware prioritization and exploitability reasoning\n\nPartner with engineers on how findings are presented in the UI and how remediation flows work\n\nWork with PM and design on roadmap priorities, providing the security expertise that drives what to build next\n\nReview and shape architectural choices that affect security outcomes\n\nEngage with customers directly to understand how they use the platform and what's blocking adoption\n\nBenchmark our output quality against competitors and close gaps where they exist\n\nContribute back to the open source security tooling we depend on where it makes sense\n\nQualifications:\n5+ years of application security experience, with significant time shipping security products\n\nStrong programming skills in at least one of Go, Python, or TypeScript - this is a product engineering role with security depth, not security operations\n\nHands-on experience tuning security tooling for production use - reducing false positives, building suppression logic, designing severity models\n\nUnderstanding of vulnerability research, CVE/CWE taxonomies, and exploit reasoning\n\nHas worked through what makes a security finding actually actionable vs. just technically true\n\nExcellent communication skills and comfort working directly with customers\n\nPragmatic; knows how to build things fast without unnecessarily complicating things\n\nExperience in (and thrives in) a fast-moving, start-up engineering environment\n\nBonus Experience:\nPrior experience shipping a security product at a vendor\n\nContributions to open source security tooling\n\nOffensive security background or OSCP / similar certifications\n\nHands-on experience with LLM agents, tool use, or autonomous AI systems\n\nYou should apply if any of the following excite you:\nOwning the security depth of a product from tooling integration to user-facing findings\n\nBeing the security voice in a product team that ships fast and listens to customers\n\nBuilding on top of best-in-class open source tooling rather than reinventing from scratch\n\nWorking directly with security teams using the product and iterating on real-world feedback\n\nJoining a small, scrappy team where your security judgment shapes both the product and the company\n\nWhy Oneleet?\nAt Oneleet, you’ll join a tight-knit team of rebels redefining the cybersecurity industry. We move fast, own our work, and challenge outdated models to make security effortless and effective for companies.\nHere’s what makes us special:\nWe value impact over titles, autonomy over micromanagement, and clarity over jargon.\n\nYou’ll tackle meaningful, hard problems with real-world consequences.\n\nYou’ll work with smart, kind, and ambitious teammates who lift each other up.\n\nPerks & Benefits\nComprehensive health & wellness benefits\n\n20 days PTO per year, plus 8 floating holiday\n\nRemote work culture\n\nTeam off-sites in stunning places (Amsterdam, Italy, etc).\n\nCompetitive compensation & equity\n\nWe hire globally and compensate competitively within each market using geographic pay bands. The range for this role reflects a US national baseline. Offers for candidates in higher cost-of-labor markets (e.g., San Francisco, New York, Zurich) may fall at or above the top of the posted range, while offers in other markets are benchmarked to local standards and are lower. Within any range, individual compensation is determined by work location, skills and experience demonstrated through the interview process, and relevant education or training. This posting reflects base salary only and does not include equity or benefits.\n Remote-First & Global Hiring\nWe’re a remote-first company and hire globally in regions where we can legally engage talent directly or via our employer-of-record (EOR) partner. If you’re based outside the U.S., we’ll explore the most compliant hiring arrangement for your location. We make hiring decisions based on merit, skills, and potential regardless of location.\nU.S. Hiring & E-Verify\nFor U.S.-based candidates, Oneleet participates in E-Verify to confirm employment eligibility, in accordance with federal regulations. We are an equal opportunity employer. We do not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other characteristic protected by applicable law. \nHow we use AI in this Hiring Process\nThis company uses automated technology, including AI-assisted tools, to assist in reviewing applications, assessing candidate qualifications, and detecting fraudulent submissions. These tools analyze application data and identity signals to support, but not replace, human hiring decisions. All final hiring decisions are made by a human reviewer. Candidates who require accommodation or who wish to request information about how these tools are used, including requesting the bias audit results, may contact . This process is conducted in compliance with applicable federal, state, and local laws.\n Notice for New York City Residents:\nYou have a right to take at least 10 business days to decide whether to proceed with submitting your information through this process. By continuing, you confirm your understanding of this notice. If you choose to proceed before the 10-business-day period expires, you are making a knowing and voluntary decision to do so.","description_format":"text","description_chars":8216,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"},{"name":"Italy","iso":"IT","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Information Security","Security Compliance"],"lifecycle":[{"event":"open","at":"2026-05-28T20:52:13Z"}],"visa":[],"liveness":{"score":35,"band":"fade","label":"Fading","p_open":1,"p_active":0.785,"p_room":0.44,"age_days":140,"expected_fill_days":108,"reasons":["conf:2","win:tail","crowd:"],"computed_at":"2026-10-16T05:45:00Z"},"pay":{"stated_usd_annual":220000,"is_top_pay":true},"html_url":"https://alion.io/job/oneleet-application-security-engineer","json_url":"https://alion.io/job/oneleet-application-security-engineer.json","meta":{"generated_at":"2026-10-17T00:57:16Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1312,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1055},"rest":"https://alion.io/mcp/rest/get_company?id=1055"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Foneleet-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Foneleet-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Foneleet-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/oneleet-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Foneleet-application-security-engineer"}]}