{"id":782069,"url":"https://alion.io/job/onepay-security-and-threat-operations-engineer","title":"Security and Threat Operations Engineer","company":{"id":2983,"name":"OnePay","domain":"onepay.com","url":"https://alion.io/company/onepay","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":82,"open_postings":7,"ghost_share":0,"stale_share":0.429,"repost_share":0.143,"time_to_fill_p50_days":83,"computed_at":"2026-11-03T05:54:40Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":140000,"max":190000,"currency":"USD","period":"year","gross":null,"usd_annual":190000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"Amazon CloudWatch","optional":false},{"name":"AWS","optional":false},{"name":"Datadog","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Wiz","optional":false},{"name":"Claude Code","optional":true},{"name":"Cursor","optional":true},{"name":"JavaScript","optional":true},{"name":"Kubernetes","optional":true},{"name":"Nest.JS","optional":true},{"name":"Node JS","optional":true},{"name":"React Native","optional":true},{"name":"React.js","optional":true},{"name":"TypeScript","optional":true}],"status":"live","first_seen_at":"2026-09-11T21:18:35Z","employer_posted_date":"2026-09-11","last_verified_at":"2026-11-03T03:28:05Z","board_verified":true,"closed_at":null,"days_open":52,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":52},"description":"About OnePay\nOnePay is the consumer fintech trusted by millions of Americans to make money better.\nOur financial system is broken. High fees, low rates, and too few ways to actually grow your money. We’re fixing it. And we’re moving fast.\nWe’re an all-in-one financial services platform that brings together banking, high-yield savings, credit cards, point-of-sale lending, investing, and crypto in one place. We also partner with employers, HCM providers, gig platforms, and others to deliver embedded financial services to millions of employees and frontline workers.\nWe’re backed by Walmart, the world’s largest retailer, and Ribbit Capital, one of fintech’s most respected investors, giving us rare scale, distribution, and the opportunity to build something truly category-defining.\nBut what really sets OnePay apart is how we move. Our customers don’t have time to wait… and neither do we. This place moves fast, and we’re looking for people who are:\nReady to run\n\nHungry and driven by urgency\n\nExceptional at what they do, with low ego\n\nComfortable operating in motion\n\nThe Role\nAs a Security and Threat Operations Engineer at OnePay, your work will have a direct impact on protecting our fast-moving fintech environment. You will turn production signals into actionable detection, response, and hardening initiatives, partnering closely with Product Security, Platform Security, and Engineering teams. Your efforts will enable us to proactively identify, monitor, and stop compromised behaviors across OnePay's products and infrastructure, ensuring the continued safety and trust of our business and customers. You will:\nBuild and tune detections, alerts, and monitoring workflows across cloud, application, identity, and edge environments.\n\nReview traffic patterns across APIs, authentication flows, and WAF telemetry to identify malicious activity, abuse patterns, and anomalous behavior.\n\nUse AI responsibly as a force multiplier for triage, analysis, and workflow automation, while helping define guardrails for AI-enabled systems.\n\nHelp operate OnePay's vulnerability management program by triaging, prioritizing, and driving remediation for findings from Wiz, vulnerability scanning, and related workflows.\n\nDevelop Python-based tooling and automation to improve investigations, enrichment, response, and operational scale.\n\nPartner with Product Security to translate threat models, security reviews, and product risks into production detections and response playbooks.\n\nInvestigate security events end to end, including triage, scoping, containment support, and follow-through on remediation.\n\nSupport vulnerability management and operational security practices in ways that align with PCI and SOC 2 expectations.\n\nParticipate in proactive threat hunting, detection improvement, and a 24x7 security incident response on-call rotation.\n\nYou Bring\n5+ years of experience in information security, threat detection, security operations, detection engineering, or incident response, ideally in a cloud-native or product-focused environment.\n\nStrong experience investigating suspicious activity in web, API, authentication, and infrastructure telemetry, with the ability to distinguish attacker behavior from normal production noise.\n\nDemonstrated ability to review traffic and event patterns for signs of malicious activity, fraud, account abuse, credential attacks, reconnaissance, and exploitation attempts.\n\nStrong Python programming skills and the ability to write maintainable code for automation, enrichment, analysis, and security operations tooling.\n\nExperience building and tuning detections in a SIEM or detection platform and working with observability and logging systems such as CloudWatch, Datadog, or similar platforms.\n\nExperience operating or supporting a vulnerability management program, including triage, prioritization, remediation tracking, and stakeholder coordination.\n\nFamiliarity with cloud and application security findings from platforms such as Wiz, including CNAPP, runtime, code, and vulnerability scanning use cases.\n\nExperience with at least one major cloud provider, preferably AWS.\n\nWorking knowledge of identity and access systems, modern authentication flows, and the security implications of internet-facing applications and APIs.\n\nStrong understanding of threat modeling, risk prioritization, and practical security controls across applications, infrastructure, and cloud environments.\n\nPractical experience using AI tools in security workflows, along with sound judgment about AI-specific risks such as prompt injection, data leakage, excessive tool access, and weak auditability.\n\nExcellent analytical, communication, and cross-functional collaboration skills, especially in environments where security needs to move quickly with product and engineering teams.\n\nDrive and proactivity - everyone here is a builder and executor\n\nTools We Use\nWe use Node and TypeScript on the server, leveraging the NestJS framework within a microservice-oriented architecture running on Kubernetes and AWS. On the client side, we build and ship product features for iOS, Android, and web platforms using React Native. We also embrace AI-assisted development, so engineers have their choice of Claude Code or Cursor to fit their workflow. While you don't need experience with our exact stack, familiarity with modern software engineering practices will help you ramp up quickly.\nWhat We Offer\nCompetitive base salary, stock options, and health benefits from Day 1\n\n401(k) plan with company match\n\nRemote-friendly (US), flexible time off (FTO), and opportunities for growth\n\nA high-growth, mission-driven, inclusive culture where your work has real impact\n\nStandard Interview Process\nOur process varies by role. Most candidates go through:\nAI-assisted initial screen\n\nInterview with Talent Partner\n\nTechnical or Hiring Manager Interview\n\nTeam Interview\n\nExecutive Interview\n\nOffer!\n\nEqual Employment Opportunity\nTo build technology and products that are used and loved by people and solve real-world problems, we need to build a team with many different perspectives and experiences. We are an equal opportunity employer. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status. We encourage candidates from all backgrounds to apply. Applicants in need of special assistance or accommodation during the interview process or in accessing our website may contact us at .","description_format":"text","description_chars":6525,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Flexible time off","Stock options"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Digital Banks & Neobanks"],"lifecycle":[{"event":"open","at":"2026-09-12T00:58:35Z"}],"visa":[],"liveness":{"score":81,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":0.9,"age_days":52,"expected_fill_days":83,"reasons":["conf:2","velocity","win:mid"],"computed_at":"2026-11-03T05:54:40Z"},"pay":{"stated_usd_annual":190000,"is_top_pay":true},"html_url":"https://alion.io/job/onepay-security-and-threat-operations-engineer","json_url":"https://alion.io/job/onepay-security-and-threat-operations-engineer.json","meta":{"generated_at":"2026-11-03T06:51:29Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9613,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-04T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2983},"rest":"https://alion.io/mcp/rest/get_company?id=2983"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fonepay-security-and-threat-operations-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fonepay-security-and-threat-operations-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fonepay-security-and-threat-operations-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/onepay-security-and-threat-operations-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fonepay-security-and-threat-operations-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":782069}},{"tool":"search_jobs","arguments":{"company":"onepay.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":782069},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}