Application Security Engineer

OneStream

7d•$114,000 - $148,000•Remote

About The Position

OneStream is seeking an Application Security Engineer to join its Information Security team and help secure the OneStream platform. The role focuses on triaging and validating findings from application security tools, partnering with engineering teams on practical remediation, and supporting security design reviews and threat modelling for new features throughout the software development lifecycle. The engineer will also use automation and AI-assisted tooling to reduce repetitive work and enable the team to focus on higher-impact security issues. The ideal candidate combines software engineering and security experience with a foundation in secure development practices and familiarity with SAST, SCA, and DAST tools. Working knowledge of C# and .NET is a bonus. The role calls for a pragmatic, collaborative, self-motivated individual who can explain technical details to both technical and non-technical audiences and help integrate security into existing development workflows.

Requirements

BSc/BA in Computer Science, Engineering, or a relevant field and at least 5 years of experience in application security, software development, or DevSecOps; or an MSc/MA in a relevant field and at least 1 year of such experience; or an associate degree in a relevant field and at least 5 years of such experience.
Ability to triage and prioritize security findings based on exploitability and business impact.
Working knowledge of application security tools such as SAST, SCA, and DAST.
Understanding of secure design principles and ability to contribute to security architecture reviews and threat modelling.
Collaborative and pragmatic approach to fitting security into existing team workflows.
Self-motivated, eager to learn, and able to work as a self-starter.
Organized, with strong reasoning skills and good judgment.
Ability to multitask and prioritize a variety of projects.
Comfort communicating with all levels of management.
Ability to explain and discuss technical details with technical and non-technical audiences.
Legal authorization to work for any company in the country where the position is located without sponsorship.

Nice To Haves

Experience writing or reviewing C# and .NET code.
Software development background and understanding of secure coding practices and common vulnerability classes, such as the OWASP Top 10.
Hands-on experience with SAST, SCA, and/or DAST tools and triaging their output.
Experience using AI tools or LLMs to automate repetitive tasks, such as reviewing findings, summarizing results, or drafting remediation guidance.
Experience with CI/CD pipelines and DevSecOps practices.
Scripting or automation experience, such as Python or PowerShell.
Familiarity with threat modelling methodologies, such as STRIDE.
Exposure to Burp Suite or similar tools for validating web application findings.
Familiarity with security risk management, SOC 2, FedRAMP, security policies and procedures, or security auditing.
Industry-recognized certifications, such as CompTIA Security+, CSSLP, GSSP-.NET, or other application security or secure development certifications.
Experience with OneStream Software or a financial consolidation package.

Responsibilities

Triage and validate findings from SAST, SCA, and DAST tools, prioritizing them by exploitability and real-world risk.
Partner with Development and Engineering teams to remediate vulnerabilities by providing clear, practical guidance.
Participate in security architecture reviews and threat modelling for new features and services.
Integrate and tune application security tools in CI/CD pipelines so security checks fit developer workflows.
Use AI-assisted tools and automation to streamline repetitive work, including reviewing and summarizing findings, removing duplicates and false positives, creating tickets, and reporting.
Write scripts and lightweight tools to automate recurring security workflows.
Review the SDLC and software supply chain, including third-party dependencies, to identify security improvements.
Perform targeted manual validation of findings when needed to confirm impact.
Track remediation progress and document and report security concerns and trends.
Contribute to secure development guidance, standards, and developer education.
Share findings and improve the overall security posture with other members of the Security team.