Senior Application Security Engineer

Role Description

The Senior Application Security Engineer joins the Information Security team and plays a key role in securing the OneStream platform throughout the software development lifecycle. This role is responsible for:

• Defining and enforcing secure coding and development practices.
• Performing application security testing to identify risks and vulnerabilities before release and in production.
• Reviewing the output of application security tools to provide clear remediation guidance across the organization.
• Partnering with engineering teams on the planning and architecture of new features.
• Contributing to platform security design.
• Leading or supporting the development of custom security tools and scanning capabilities.
• Communicating effectively across technical and non-technical audiences.
• Developing proof-of-concept exploits to validate vulnerabilities and assess real-world risk.

Qualifications

• Bachelor’s degree in Computer Science, Engineering, or a related field with 8+ years of experience in application security testing, penetration testing, or software development; or
• Master’s degree in Computer Science, Engineering, or a related field with 3+ years of experience in application security testing, penetration testing, or software development; or
• Associate degree in Computer Science, Engineering, or a related field with 12+ years of experience in application security testing, penetration testing, or software development.
• 3+ years of hands-on experience conducting threat modeling for applications and systems and translating findings into actionable remediation guidance.

Requirements

• Experience writing and reviewing C# and .NET code, including secure coding and code review practices.
• Hands-on experience performing penetration testing of web applications.
• Experience decompiling and reverse engineering .NET libraries.
• Broad experience across IT security and infrastructure, security risk management, and compliance frameworks such as SOC 2 and FedRAMP.
• Industry-recognized offensive security or penetration testing certifications, such as:
• Offensive Security Certified Professional (OSCP)
• GIAC Exploit Researcher and Advanced Penetration Tester (GXPN)
• GIAC Penetration Tester (GPEN)
• Other relevant offensive security or penetration testing certifications
• Outstanding written and verbal communication skills, with the ability to clearly explain complex technical concepts to both technical and non-technical audiences.

Benefits

• Excellent Medical Plan
• Dental & Vision Insurance
• Life Insurance
• Short & Long Term Disability
• Vacation Time
• Paid Holidays
• Professional Development
• Retirement Plan