Senior Application Security Engineer

OneStream Software•,

13h•$150,000 - $196,000•Remote

About The Position

The Senior Application Security Engineer joins the Information Security team and plays a key role in securing the OneStream platform throughout the software development lifecycle. This role is responsible for defining and enforcing secure coding and development practices, performing application security testing to identify risks and vulnerabilities before release and in production, and reviewing the output of application security tools to provide clear remediation guidance across the organization. In addition, the Senior Application Security Engineer partners with engineering teams on the planning and architecture of new features, contributes to platform security design, and leads or supports the development of custom security tools and scanning capabilities. The ideal candidate brings a strong foundation in secure development and programming practices, hands-on experience with C# and .NET, and a passion for protecting customers. This role requires effective communication across technical and non-technical audiences and may involve developing proof-of-concept exploits to validate vulnerabilities and assess real-world risk.

Requirements

Bachelor’s degree in Computer Science, Engineering, or a related field with 8+ years of experience in application security testing, penetration testing, or software development; or Master’s degree in Computer Science, Engineering, or a related field with 3+ years of experience in application security testing, penetration testing, or software development; or Associate degree in Computer Science, Engineering, or a related field with 12+ years of experience in application security testing, penetration testing, or software development.
3+ years of hands-on experience conducting threat modeling for applications and systems and translating findings into actionable remediation guidance.

Nice To Haves

Experience writing and reviewing C# and .NET code, including secure coding and code review practices.
Hands-on experience performing penetration testing of web applications.
Experience decompiling and reverse engineering .NET libraries.
Broad experience across IT security and infrastructure, security risk management, and compliance frameworks such as SOC 2 and FedRAMP, including security policies, procedures, testing, auditing, and internal audit.
Industry-recognized offensive security or penetration testing certifications, such as: Offensive Security Certified Professional (OSCP), GIAC Exploit Researcher and Advanced Penetration Tester (GXPN), GIAC Penetration Tester (GPEN), Other relevant offensive security or penetration testing certifications
Outstanding written and verbal communication skills, with the ability to clearly explain complex technical concepts to both technical and non-technical audiences.
Highly organized with strong analytical and reasoning skills.
Self-motivated self-starter who works effectively both independently and with minimal direction.
Independent thinker with sound judgment and the ability to make well-reasoned decisions.
Ability to think quickly, evaluate trade-offs, and make decisions in fast-paced environments.
Strong prioritization and multitasking skills, with the ability to manage multiple initiatives simultaneously.
Comfortable communicating and collaborating with stakeholders at all levels of the organization, including senior leadership.
Experience with OneStream Software is not required; experience with financial consolidation or enterprise performance management platforms is a plus.

Responsibilities

Perform manual and automated application security testing to identify vulnerabilities across the OneStream platform.
Conduct code analysis to assess and ensure the security of application code.
Evaluate the software development lifecycle (SDLC) to identify opportunities to strengthen application and supply chain security.
Partner with Development and Engineering teams to embed security into OneStream services and workflows.
Collaborate with members of the Security team to identify attack patterns and indicators of compromise.
Design, develop, and maintain custom security testing tools to support internal testing efforts.
Define, document, and enforce secure development policies, standards, and procedures.
Provide mentorship and technical guidance to junior members of the Security team to support growth and knowledge sharing.
Document, communicate, and report security findings and risks identified during testing activities.
Perform penetration testing against OneStream assets to validate application and infrastructure security.
Conduct security architecture and design reviews to ensure secure-by-design implementations.
Provide secure design and secure coding guidance to engineering teams throughout the development lifecycle.