[Hiring] Senior Application Security Engineer @One Identity

Role Description

Our products are the access control layer for the companies that buy them. Identity Manager, Active Roles, Safeguard and OneLogin decide who gets into everything else a customer runs. That sets the security bar for our code higher than it sits at most software companies, and it's the reason this role works inside engineering rather than alongside it.

Much of what we build is deployed by customers in their own datacenters. When a defect ships, remediation moves at their upgrade cadence, not ours. That changes where the effort belongs: a design flaw caught in a threat model costs a conversation, and the same flaw caught after release costs a coordinated disclosure and a year of upgrade calls. This role is funded to move security earlier.

We're separating from Quest Software and building an independent security function. The team is lean and globally distributed, and this role is the security voice in the product organization. Scope comes from what you build into the development lifecycle and from what engineering chooses to adopt.

What you'll do

• Design it right
  • Threat model the things that matter: authentication and session handling, privilege elevation paths, connector and integration boundaries, tenant isolation in hosted offerings, and cryptographic and secrets handling.
  • Set security requirements early enough to shape a design instead of contesting one.
  • Give product and engineering leadership a defensible read on which risks are worth carrying.
• Work in the code
  • Hold commit access to product repositories.
  • Own static analysis, dependency scanning, and dynamic testing across the product lines.
  • Raise the ceiling on secure coding across a large .NET and Java codebase.
  • Take a position on AI-assisted development.
• Stand behind what ships
  • Own product vulnerability response end to end.
  • Turn penetration test and bug bounty findings into fixes and systemic change.
  • Own software composition analysis and SBOM generation across the product lines.
  • Make product security evidence available on demand.

Qualifications

• Six or more years in software engineering or security, with at least three focused on application or product security.
• Application security experience on a product that customers deploy and operate themselves.
• Code-level fluency in C# and .NET, and enough range to be useful in a Java codebase.
• Hands-on work with AI-assisted development or AI-enabled security tooling within the last six months.

Requirements

• Threat modeling at design time with engineering in the room.
• Static, dynamic and composition analysis tooling and the judgment to tune it.
• Identity and authentication protocols including OAuth, OIDC, SAML and SCIM.
• Coordinated vulnerability disclosure and CVE handling.
• Secure code review depth in web and API surfaces.
• The ability to hold a position with senior engineers and change it when they're right.

Benefits

• Collaborate with dedicated professionals with a passion for technology.
• Opportunity to build and develop products at a scale few others can provide.
• Enhanced career opportunities for team members to learn and grow.
• Health and wellness priority for team members.
• Rewarding hard work through various programs.

Company Description

One Identity enables organizations of all sizes to better secure, manage, monitor, protect, and analyse information and infrastructure to help fuel innovation and drive their businesses forward.

With team members around the globe, we intend to continue to grow revenues and add value to customers.

When you join our team, you will have the opportunity to build and develop products at a scale few others can provide.

Our product portfolio serves a large base of customers and we are addressing the strategic imperatives for enterprise businesses.

Working with some of the most talented employees the industry has to offer, we provide enhanced career opportunities for team members to learn and grow in a rapidly changing environment.