{"id":3842882,"url":"https://alion.io/job/opensesame-senior-security-analyst","title":"Senior Security Analyst","company":{"id":3735,"name":"OpenSesame","domain":"opensesame.com","url":"https://alion.io/company/opensesame","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":130000,"max":190000,"currency":"USD","period":"year","gross":null,"usd_annual":190000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"Confluence","optional":false},{"name":"Crowdstrike","optional":false},{"name":"GCP","optional":false},{"name":"GitHub","optional":false},{"name":"ISO 27001","optional":false},{"name":"ISO 42001","optional":false},{"name":"Jira","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Python","optional":false},{"name":"Threat Modeling","optional":false}],"status":"live","first_seen_at":"2026-11-05T23:32:54Z","employer_posted_date":"2026-11-05","last_verified_at":"2026-11-11T15:49:39Z","board_verified":true,"closed_at":null,"days_open":5,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":5},"description":"About OpenSesame\nOpenSesame is the trusted partner for Workforce Reinvention in the age of AI. OpenSesame delivers integrated software, curated and customizable content, and expert services - embedded into existing learning, HR, and work systems - to help organizations expand their human+AI potential and thrive through change.\nLearn more:www.opensesame.com/about\nAbout the Role\nAs a Senior Security Analyst on our Compliance team, you will play a key role in strengthening OpenSesame’s security posture in a fast-moving, high-growth environment. We’re looking for someone who brings deep technical security expertise, a proactive mindset, and the ability to turn complex risks into practical, scalable solutions.\nThis role spans vulnerability management, penetration testing, bug bounty operations, cloud and application security, and audit readiness. You’ll partner across Engineering, DevOps, IT, and Compliance to improve security processes, support compliance efforts, and help ensure security is built into how we work, especially as we continue evolving our approach to AI security. We’re looking for proven examples from your career that show you can do this job; that you’ve owned penetration testing programs, built vulnerability management systems, implemented security automation, and helped organizations adopt modern technologies (including AI) securely and responsibly.\nYou’ll be a strong fit if you’re detail-oriented, collaborative, and excited to build programs that reduce risk, improve visibility, and support safe innovation across the business.\nPerformance Objectives\nEstablish Security Ownership & Technical Depth (0-6 Months)\nDevelop a comprehensive view of OpenSesame’s external attack surface, vulnerabilities, and threat landscape - integrating signals from CrowdStrike, cloud environments (AWS, GCP), and application security tooling.\nOwn external penetration testing engagements end-to-end - including vendor selection, scope design, execution oversight, remediation validation, and executive reporting.\nBuild and operationalize a structured vulnerability management program - partnering with DevOps, Engineering, and IT to prioritize and remediate risk effectively.\nStand up scalable evidence collection and control mapping workflows in Drata - improving audit readiness and reducing manual effort.\nEstablish strong cross-functional relationships to embed security into engineering, infrastructure, and IT workflows from the outset.\nOperationalize Continuous & AI-Aware Security (6-12 Months)\nDesign and implement a continuous penetration testing program that complements annual third-party testing - leveraging automation, threat modeling, and targeted validation.\nOwn and mature the bug bounty program - improving signal quality, triage processes, researcher engagement, and remediation workflows.\nLead implementation of AI security practices across internal systems and product development:Apply OWASP Top 10 for LLMs / AI systems to identify and mitigate emerging risks\nSupport adoption and operationalization of ISO 42001 controls\nDefine secure usage patterns for internal AI tools and third-party AI integrations\n\nPartner with Product Engineering to define and enforce secure AI and application baseline requirements - ensuring security is built into system design, not retrofitted.\nDevelop automations and tooling (Python, APIs, Make) to continuously collect threat intelligence, validate security baselines, and detect drift across AWS, GCP, GitHub, and SaaS platforms.\nImprove Jira and Confluence workflows to create visibility, accountability, and measurable progress across security findings and remediation.\nProvide deep technical support during audits - translating real-world implementations into clear, defensible narratives aligned with ISO 27001, ISO 27701, and ISO 42001.\nDrive Security Maturity & Compliance Integration (12+ Months)\nServe as a senior technical partner to Compliance - supporting vendor reviews, customer security questionnaires, and control design with practical, implementation-level expertise.\nContinuously improve Drata automation and evidence pipelines - moving toward near real-time compliance visibility.\nPartner with Engineering and DevOps leadership to evolve secure development practices, CI/CD security controls, and cloud security baselines.\nEstablish and refine AI security governance models - balancing innovation with risk management across internal and customer-facing use cases.\nIdentify systemic risks, recurring vulnerability patterns, and process inefficiencies - driving durable, organization-wide improvements.\nContribute to long-term security strategy - aligning threat management, AI adoption, compliance requirements, and engineering velocity.\nWhat Success Looks Like\nPenetration testing (external and continuous) is predictable, effective, and drives measurable reductions in risk.\nVulnerabilities are prioritized intelligently and remediated within defined SLAs, with clear ownership across teams.\nThe bug bounty program consistently yields high-quality findings with efficient triage and response.\nAI systems and tools are deployed with clear security guardrails aligned to OWASP AI Top 10 and ISO 42001.\nEngineering teams proactively incorporate security - including AI security - into design and development workflows.\nAudit readiness becomes continuous rather than event-driven, with strong evidence pipelines in Drata.\nSecurity is viewed as a strategic enabler of safe innovation, not a bottleneck.\nYou might notice we don’t have the typical list of requirements and buzzwords here. That’s intentional.\nWe’re looking for proven examples from your career that show you can do this job - that you’ve owned penetration testing programs, built vulnerability management systems, implemented security automation, and helped organizations adopt modern technologies (including AI) securely and responsibly.\nWhen you look back a year from now, you’ll know you’ve made OpenSesame more secure, more resilient, and better positioned to innovate with confidence.\nAlthough it should go without saying (but it doesn’t), OpenSesame is an equal opportunity employer and we strive to create a welcoming, inclusive environment that celebrates diversity.\nLocation: This position can be based anywhere in the US. We operate as a remote-first company, and invest in mandatory all-company meetings several times a year in addition to required team travel as necessary.\nPerformance Driven: We're looking for self-starters with a track record of delivering excellent results, but we're highly selective about who we hire. We don't focus on typical job requirements, instead, we're interested in specific examples from your past experiences. All positions can be based anywhere in the US, and require up to 15 days of travel per year, with senior management and leadership teams requiring up to 35 days.\nCompensation: The base salary for this position generally ranges between $130,000 and $190,000 depending on experience. At OpenSesame, we offer a comprehensive benefits package to employees upon hire, including professional development, ISOs, health insurance, 401(k) matching, and paid time off. \nBenefits: Benefits include comprehensive medical, dental, and vision coverage, flexible PTO, 401(k) matching, incentive stock options, volunteer time off, Employee Resource Groups, and a generous professional development program with dedicated annual time off for learning and growth.\nWe use AI. For real. Every team at OpenSesame works with AI tools daily, not as a buzzword, but as practice. You'll build fluency that most companies are still talking about adopting, with hands-on training and clear guardrails to experiment responsibly. AI amplifies your creativity and judgment. It doesn't replace them. The skills you build here travel with you.\nEqual Employment Opportunity: OpenSesame is an Equal Employment Opportunity and Affirmative Action employer that values and welcomes diversity. We do not discriminate on the basis of various legally protected characteristics, including criminal history, and strive to provide reasonable accommodations to qualified individuals with disabilities. We prioritize safety and security and may use your information accordingly, and you can contact us for assistance or accommodations during the job application process. \nPay Transparency: At OpenSesame, we prioritize pay transparency, fairness, and equity to create a positive and inclusive work environment, regularly reviewing our compensation practices to align with our values and goals. We provide competitive and fair compensation to our employees based on their skills, experience, and performance.\nCPRA (California Candidates): When you submit your application, OpenSesame may collect and use your personal information in accordance with our privacy policy and the CPRA. This may include personal details and employment history, and will only be used for employment-related purposes. We may share this information with third-party service providers, but we will not sell it to third parties. If you have any questions or concerns, please contact us, and for more information on your rights under the CPRA, refer to our privacy policy or the California Attorney General's website.","description_format":"text","description_chars":9257,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Health insurance","Professional development","Stock options"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Corporate Training","E-learning"],"lifecycle":[{"event":"open","at":"2026-11-05T23:39:15Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":5,"expected_fill_days":56,"reasons":["conf:3","win:early"],"computed_at":"2026-11-11T05:49:22Z"},"pay":{"stated_usd_annual":190000,"is_top_pay":true},"html_url":"https://alion.io/job/opensesame-senior-security-analyst","json_url":"https://alion.io/job/opensesame-senior-security-analyst.json","meta":{"generated_at":"2026-11-11T16:28:33Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":31109,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-12T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3735},"rest":"https://alion.io/mcp/rest/get_company?id=3735"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fopensesame-senior-security-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fopensesame-senior-security-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fopensesame-senior-security-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/opensesame-senior-security-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fopensesame-senior-security-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3842882}},{"tool":"search_jobs","arguments":{"company":"opensesame.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3842882},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}