Application Security Engineer
Application Security Engineer on OneStream's Information Security team: triages and validates findings from SAST/SCA/DAST tools, partners with engineers on remediation, supports security design reviews and threat modeling across the SDLC, and automates repetitive security work using scripts and AI-assisted tooling.
- Compensation
- $114K–$148K / yr
- Location
- United States
- Work setup
- Not specified
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- 1+ years
- Category
- Security
- Posted
Skills
Must have
- BSc/BA in Computer Science, Engineering, or relevant field with 5+ years of experience in application security, software development, or DevSecOps
- OR MSc/MA in Computer Science, Engineering, or relevant field with 1+ year of experience in application security, software development, or DevSecOps
- OR Associate degree in Computer Science, Engineering, or relevant field with 5+ years of experience in application security, software development, or DevSecOps
- Working knowledge of application security tools such as SAST, SCA, and DAST
- Ability to triage and prioritize security findings based on exploitability and business impact
- Ability to explain and discuss technical details with technical and non-technical audiences
Nice to have
- Experience writing or reviewing C# & .NET code
- Software development background with understanding of secure coding practices and common vulnerability classes (e.g., OWASP Top 10)
- Hands-on experience with SAST, SCA, and/or DAST tools and triaging their output
- Experience using AI tools or LLMs to automate repetitive work
- Experience with CI/CD pipelines and DevSecOps practices
- Scripting or automation experience (e.g., Python, PowerShell)
- Familiarity with threat modelling methodologies (e.g., STRIDE)
- Exposure to Burp Suite or similar tools for validating web application findings
- Familiarity with security risk management, SOC2, FedRAMP, security policies & procedures, or security auditing
- Industry certifications such as CompTIA Security+, CSSLP, or GSSP-.NET
- Experience with any financial consolidation package
Full description
At OneStream, we're on a mission to empower every Finance organization and professional to exceed their potential. Our global teams span continents, cultures, and time zones, united by a shared purpose as we build the operating system for modern Finance and help organizations move with greater speed, clarity, and confidence.
That mission comes to life through our people. Behind every innovation, customer success, and milestone are talented people working together to make a difference. That's why we're looking for people who are bold enough to think big, authentic in how they lead and collaborate, curious about what's possible, and committed to delivering results.
Want a closer look before you apply? Explore our Careers site to learn more about our people, culture, and benefits.
Summary
We are looking for an Application Security Engineer to join the Information Security team. In this role, you will help keep the OneStream platform secure by triaging and validating findings from application security tools, partnering with engineering teams on practical remediation, and supporting security design reviews and threat modelling for new features throughout the SDLC. You will also use automation and AI-assisted tooling to take on repetitive work, such as reviewing and summarizing findings, so the team can focus on higher-impact security problems.
The ideal candidate has experience in software engineering and security, with a solid foundation in secure development practices, familiarity with application security tools (SAST, SCA, and DAST), and a passion for securing our platform for our customers. Working knowledge of C# and .NET is a bonus. We are looking for a go-getter who is eager to learn, collaborates well with teams across all levels of the organization, and brings a pragmatic approach to security that keeps delivery moving. This position requires the ability to explain and discuss technical details with both technical and non-technical audiences.
Primary Duties and Responsibilities
- Triage and validate findings from application security tools (SAST, SCA, and DAST), prioritizing by exploitability and real-world risk.
- Partner with Development and Engineering teams to remediate vulnerabilities with clear, practical guidance.
- Participate in security architecture reviews and threat modelling for new features and services.
- Integrate and tune application security tooling in CI/CD pipelines so security checks fit naturally into developer workflows.
- Use AI-assisted tools and automation to streamline repetitive tasks such as reviewing and summarizing findings, removing duplicates and false positives, creating tickets, and reporting.
- Write scripts and lightweight tooling to automate recurring security workflows.