Senior Application Security Engineer

OneStream Software is a company focused on enhancing finance teams' capabilities by unifying financial and operational data. The Senior Application Security Engineer will play a crucial role in securing the OneStream platform throughout the software development lifecycle, defining secure coding practices, and conducting application security testing to identify risks and vulnerabilities.

Responsibilities:

• Perform manual and automated application security testing to identify vulnerabilities across the OneStream platform
• Conduct code analysis to assess and ensure the security of application code
• Evaluate the software development lifecycle (SDLC) to identify opportunities to strengthen application and supply chain security
• Partner with Development and Engineering teams to embed security into OneStream services and workflows
• Collaborate with members of the Security team to identify attack patterns and indicators of compromise
• Design, develop, and maintain custom security testing tools to support internal testing efforts
• Define, document, and enforce secure development policies, standards, and procedures
• Provide mentorship and technical guidance to junior members of the Security team to support growth and knowledge sharing
• Document, communicate, and report security findings and risks identified during testing activities
• Perform penetration testing against OneStream assets to validate application and infrastructure security
• Conduct security architecture and design reviews to ensure secure-by-design implementations
• Provide secure design and secure coding guidance to engineering teams throughout the development lifecycle

Requirements:

• One of the following combinations of education and experience: Bachelor's degree in Computer Science, Engineering, or a related field with 8+ years of experience in application security testing, penetration testing, or software development; or Master's degree in Computer Science, Engineering, or a related field with 3+ years of experience in application security testing, penetration testing, or software development; or Associate degree in Computer Science, Engineering, or a related field with 12+ years of experience in application security testing, penetration testing, or software development
• 3+ years of hands-on experience conducting threat modeling for applications and systems and translating findings into actionable remediation guidance
• Experience writing and reviewing C# and .NET code, including secure coding and code review practices
• Hands-on experience performing penetration testing of web applications
• Experience decompiling and reverse engineering .NET libraries
• Broad experience across IT security and infrastructure, security risk management, and compliance frameworks such as SOC 2 and FedRAMP, including security policies, procedures, testing, auditing, and internal audit
• Industry-recognized offensive security or penetration testing certifications, such as: Offensive Security Certified Professional (OSCP), GIAC Exploit Researcher and Advanced Penetration Tester (GXPN), GIAC Penetration Tester (GPEN), Other relevant offensive security or penetration testing certifications
• Outstanding written and verbal communication skills, with the ability to clearly explain complex technical concepts to both technical and non-technical audiences