{"id":2558037,"url":"https://alion.io/job/opendoor-application-security-engineer","title":"Application Security Engineer","company":{"id":2680,"name":"Opendoor","domain":"opendoor.com","url":"https://alion.io/company/opendoor-labs-inc","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Schema","truth_index":{"grade":"A","score":95,"open_postings":32,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":113,"computed_at":"2026-10-16T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"Apollo","optional":false},{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"GitHub","optional":false},{"name":"Go","optional":false},{"name":"GraphQL","optional":false},{"name":"gRPC","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"Rest API","optional":false},{"name":"Ruby","optional":false},{"name":"Semgrep","optional":false},{"name":"Shift-Left","optional":false},{"name":"Shift-Left Security","optional":false},{"name":"Slack","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"Azure","optional":true},{"name":"Claude","optional":true},{"name":"Cloudflare WAF","optional":true},{"name":"CodeQL","optional":true},{"name":"Dependabot","optional":true},{"name":"GCP","optional":true},{"name":"Machine Learning","optional":true},{"name":"OpenAI","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-06-17T20:18:36Z","employer_posted_date":"2026-06-17","last_verified_at":"2026-10-16T19:29:24Z","board_verified":true,"closed_at":null,"days_open":121,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":120},"description":"About Opendoor\nAt Opendoor our mission is to tilt the world in favor of homeowners and those who aim to become one. Homeownership matters. It's how people build wealth, stability, and community. It's how families put down roots, how neighborhoods strengthen, how the future gets built. We're building the modern system of homeownership giving people the freedom to buy and sell on their own terms. We’ve built an end-to-end online experience that has already helped thousands of people and we’re just getting started.\nAbout The Role\nOur Security Engineering team builds intelligent systems that protect Opendoor and our customers while enabling unprecedented engineering velocity. We apply software engineering and AI to solve security problems across product, infrastructure, and operations by building guardrails where they matter, not gates where they don't.\nAs our Application Security Engineer, you'll own how we find, prioritize, and drive down application-layer risk across the consumer flows that put cash offers in homeowners’ hands, the GraphQL APIs that power our products, and the AI agents and vibe-coded tools our engineers ship every week. The job is to make it safe to build fast, not to slow things down.\nWhat You'll Do\nDefine, build and operate Opendoor’s application vulnerability identification capability - the tooling, triage workflow and remediation techniques across our consumer products, internal admin tools and GraphQL API powering home acquisition, resale, mortgage, title and escrow.\nAssess, rationalize and own our AppSec tooling stack - static and dynamic security testing, software supply chain risk detection and secrets scanning and integrate findings into developer workflows where engineers already live (GitHub, Linear, Slack).\nOwn and mature our HackerOne program: tightening the triage workflow, improving signal to noise on incoming reports, strengthening researcher relationships and closing the loop with engineering teams so root causes get addressed quickly.\nLead threat modeling and security design reviews for new services, APIs, and mobile features. Turn the patterns you see into rules, lint checks, and CI guardrails so the next team doesn't make the same mistake.\nBuild AI agents and automated workflows that triage vulnerability reports, validate exploit reproductions, and draft remediation pull requests, replacing manual security review with high-signal automation.\nPartner with engineering teams to harden authentication, authorization, and input validation across our codebase and production services, including the GraphQL gateway (Apollo) and our Kubernetes workloads - while driving a shift-left strategy that catches vulnerabilities before they ship.\nBuild Opendoor’s offensive security capability. Scope and run internal security testing, red team exercises and adversarial analysis of our highest-risk flows ensuring findings directly harden detection and response.\nSet the bar for what \"secure by default\" looks like for AI-maximalist engineering, including vibe-coded apps, MCP servers, and agent-driven workflows that touch production data.\nBuild Opendoor’s security culture by establishing secure design standards, embedding into engineering team rituals and developing a strong security mindset - creating a foundation for engineers to think like attackers without slowing down.\nTech Stack\nLanguages: Go, Python, TypeScript, Ruby, Terraform\nCloud: AWS, GCP, Azure, Kubernetes, Apollo GraphQL\nAppSec Tooling: GitHub Advanced Security (CodeQL, Dependabot, secret scanning), Semgrep, HackerOne, Burp Suite, Cloudflare WAF\nAI Tooling: Claude, OpenAI, various agent frameworks, MCP - used heavily for vulnerability triage, exploit verification, and remediation drafting\nWhat You'll Need\nDeep conviction that AI and automation should eliminate manual work and increase the team's impact, and a track record to prove it. You’ve built agentic systems that replaced reactive security work, not just configured off-the-shelf tools.\nComfort operating with high autonomy in ambiguous environments. You’ve defined what “good” looks like in a domain where no playbook existed, you’re energized by that, not unsettled by it.\nBusiness enablement security mindset. You measure success by business impact and informed risk-taking, not by tickets opened or pen test reports filed.\nApplication security or software engineering experience with a security focus, with strong skills in at least one of Python, Go, TypeScript, or Ruby, and the ability to read and write code across the others.\nHands-on expertise across the security risk detection toolchain with real deployment experience using GitHub Advanced Security, Semgrep, or equivalent.\nStrong grasp of common application and API vulnerability classes including GraphQL, REST, and gRPC security pitfalls - broken authorization, mass assignment, introspection exposure, insecure direct object references.\nPractical threat modeling skills. You can take an architecture diagram and a 30-minute conversation and walk out with the three things that actually matter.\nExperience with cloud and container security on AWS and Kubernetes, including identity and access management, secrets management, and continuous integration / continuous deployment pipeline security.\nHumility and genuine curiosity. You're as excited to learn from product engineers and enable their work as you are to break things.\nBonus Points\nOffensive security experience including pentesting, API security, or mobile security, and/or red team operations.\nExperience running a bug bounty or coordinated disclosure program at scale.\nMobile application security review experience (iOS and Android).\nExperience securing AI and machine learning pipelines, agent frameworks, or MCP-style integrations.\nOSCP, OSWE, or similar offensive certifications.\nLocation\nThis role is based in our downtown Miami office, in-person four days per week (Monday, Tuesday, Thursday, Friday). Candidates must be based within commuting distance of the office.","description_format":"text","description_chars":6002,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Residential Real Estate","PropTech"],"lifecycle":[{"event":"open","at":"2026-10-14T19:50:30Z"}],"visa":[],"liveness":{"score":29,"band":"fade","label":"Fading","p_open":1,"p_active":0.651,"p_room":0.44,"age_days":120,"expected_fill_days":113,"reasons":["conf:2","win:tail","crowd:"],"computed_at":"2026-10-16T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/opendoor-application-security-engineer","json_url":"https://alion.io/job/opendoor-application-security-engineer.json","meta":{"generated_at":"2026-10-16T20:44:46Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1399,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-17T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2680},"rest":"https://alion.io/mcp/rest/get_company?id=2680"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fopendoor-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fopendoor-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fopendoor-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/opendoor-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fopendoor-application-security-engineer"}]}