{"id":26198,"url":"https://alion.io/job/opal-security-application-security-engineer","title":"Application Security Engineer","company":{"id":6970,"name":"Opal Security","domain":"opal.dev","url":"https://alion.io/company/opal-security","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":89,"open_postings":20,"ghost_share":0.1,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":193,"computed_at":"2026-10-16T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":147000,"max_usd":285000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":425},"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon EKS","optional":false},{"name":"Auth0","optional":false},{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"Docker","optional":false},{"name":"IAM","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"GraphQL","optional":true},{"name":"PostgreSQL","optional":true},{"name":"Redis","optional":true}],"status":"live","first_seen_at":"2026-05-20T21:06:57Z","employer_posted_date":"2026-05-20","last_verified_at":"2026-10-16T14:51:10Z","board_verified":true,"closed_at":null,"days_open":148,"trust":{"level":"ok","repost_count":1,"flags":["company_stale"],"days_open":148},"description":"About Opal Security:\nAt Opal, we’re building modern identity governance for the AI era-intelligent access management that empowers enterprises to move fast while staying secure. Our mission is to bring clarity, control, and confidence to complex enterprise environments, helping teams govern access without slowing down innovation.\nThe Role:\nMost security engineers spend their careers bolting locks onto doors that were already built. This is not that job.\nWe're hiring an Application Security Engineer to own security across Opal's product and platform - and yes, own means what it sounds like. You'd be our dedicated security engineer, embedded directly with engineering, writing production code in Go and TypeScript, and building security into the product while it's still being designed. You’ll work closely with a team of engineers that genuinely care about getting this right, and a product that happens to be one of the most security-critical tools in enterprise software.\nOh, and one more thing: Opal is a security company. We sell access control to organizations that take security seriously. That means your work isn't a cost center - it's core to what we do.\nThis role lives on the Platform team and partners closely with Infrastructure Engineering on cloud security. It is explicitly scoped to application and product security - enterprise IT, compliance, and vendor risk management are handled separately.\nWhat You’ll Do:\nSecure Development Lifecycle -\nOwn the secure SDLC end-to-end: threat modeling, design reviews, code reviews - you set the bar\n\nRun and coordinate app pentests (internal and external) and drive findings to closure\n\nBuild and own SAST/DAST/SCA tooling wired into CI/CD so security ships with the code\n\nTriage and remediate vulnerabilities from every angle - bug bounty, internal scans, the works\n\nSoftware Security Engineering -\nBuild and maintain the security-critical stuff: encryption services, authz enforcement, authn flows\n\nOwn the Auth0 ↔ Opal integration - tokens, sessions, MFA, SSO (SAML, OIDC, OAuth 2.0)\n\nShip production Go and TypeScript to harden APIs, enforce least-privilege, and close vuln classes for good\n\nCreate shared libraries that make the secure path the easy path for every product engineer\n\nIncident Response & Cloud Security -\nBe first on the scene for security incidents: investigate, contain, find the root cause, fix it\n\nPartner with Infra on cloud hardening - AWS IAM, EKS, KMS, network segmentation\n\nLevel up detection and response by writing detection rules and improving logging and alerting\n\nSecurity Culture -\nMentor engineers on secure coding, common vuln patterns, and security architecture - you make the org smarter\n\nHelp set the security roadmap by grounding it in real product risk\n\nBe the security teammate engineers want to work with - a collaborator, not a bottleneck\n\nYou Might Be a Fit If You:\nHave 4+ years in application security or software security engineering\n\nActually write production code - findings reports are the floor, not the ceiling\n\nKnow auth cold: OAuth 2.0, OIDC, SAML, session management, token lifecycle\n\nAre comfortable in AWS and containerized environments (Kubernetes, Docker)\n\nBonus points for familiarity with our stack: Go, TypeScript, React, PostgreSQL, Redis, GraphQL\n\nHave led complex, cross-functional security initiatives from kickoff to completion\n\nHave run or participated in external pentests and seen findings through remediation\n\nThrive on ownership and ambiguity - you'd rather write the playbook than wait for one","description_format":"text","description_chars":3532,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Identity Management","Cloud Security","Information Security"],"lifecycle":[{"event":"open","at":"2026-05-20T21:06:57Z"},{"event":"close","at":"2026-08-13T11:33:27Z"},{"event":"reopen","at":"2026-08-29T21:45:07Z"}],"visa":[],"liveness":{"score":47,"band":"ok","label":"Likely open","p_open":1,"p_active":0.776,"p_room":0.6,"age_days":148,"expected_fill_days":193,"reasons":["conf:0","win:late","crowd:"],"computed_at":"2026-10-16T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/opal-security-application-security-engineer","json_url":"https://alion.io/job/opal-security-application-security-engineer.json","meta":{"generated_at":"2026-10-16T16:38:18Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1116,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-17T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6970},"rest":"https://alion.io/mcp/rest/get_company?id=6970"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fopal-security-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fopal-security-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fopal-security-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/opal-security-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fopal-security-application-security-engineer"}]}