[Hiring] Application Security Engineer @OneStream

Role Description

We are looking for an Application Security Engineer to join the Information Security team. In this role, you will help keep the OneStream platform secure by:

• Triage and validate findings from application security tools (SAST, SCA, and DAST), prioritizing by exploitability and real-world risk.
• Partner with Development and Engineering teams to remediate vulnerabilities with clear, practical guidance.
• Participate in security architecture reviews and threat modelling for new features and services.
• Integrate and tune application security tooling in CI/CD pipelines so security checks fit naturally into developer workflows.
• Use AI-assisted tools and automation to streamline repetitive tasks such as reviewing and summarizing findings, removing duplicates and false positives, creating tickets, and reporting.
• Write scripts and lightweight tooling to automate recurring security workflows.
• Review the SDLC and software supply chain, including third-party dependencies, to identify opportunities to improve security.
• Perform targeted manual validation of findings when needed to confirm impact.
• Track remediation progress, and document and report security concerns and trends.
• Contribute to secure development guidance, standards, and developer education.
• Work with other members of the Security team to share findings and improve overall security posture.

Qualifications

• BSc/BA in Computer Science, Engineering, or relevant field, with 5+ years of experience in application security, software development, or DevSecOps
• OR MSc/MA in Computer Science, Engineering, or relevant field, with 1+ year of experience in application security, software development, or DevSecOps
• OR Assoc. in Computer Science, Engineering, or relevant field, with 5+ years of experience in application security, software development, or DevSecOps

Requirements

• Experience writing or reviewing C# & .NET code (a strong plus).
• Software development background, with an understanding of secure coding practices and common vulnerability classes (e.g., OWASP Top 10).
• Hands-on experience with SAST, SCA, and/or DAST tools and triaging their output.
• Experience using AI tools or LLMs to automate repetitive work, such as reviewing findings, summarizing results, or drafting remediation guidance.
• Experience with CI/CD pipelines and DevSecOps practices.
• Scripting or automation experience (e.g., Python, PowerShell).
• Familiarity with threat modelling methodologies (e.g., STRIDE).
• Exposure to Burp Suite or similar tools for validating web application findings.
• Familiarity with security risk management, SOC2, FedRAMP, security policies & procedures, or security auditing.
• Any industry recognized certifications, for example:
• CompTIA Security+
• Certified Secure Software Lifecycle Professional (CSSLP)
• GIAC Secure Software Programmer - .NET (GSSP-.NET)
• Other application security or secure development certifications
• Outstanding communication skills.

Benefits

• Excellent Medical Plan
• Dental & Vision Insurance
• Life Insurance
• Short & Long Term Disability
• Vacation Time
• Paid Holidays
• Professional Development
• Retirement Plan