Application Security Engineer

📋 Job Overview

Oneleet is one of the fastest-growing security and compliance platforms in history. We are on a mission to change the compliance and security industry by making cybersecurity and compliance effective, easy, and painless. We provide a platform that helps companies build, manage, and monitor their cybersecurity programs and achieve compliance standards such as SOC 2 and ISO 27001 efficiently, without cutting corners.

🏢 About Oneleet

Having just raised a $33 million Series A, we are rapidly growing in customers and employees. Our team has decades of experience in security and compliance. Join our team of opinionated rebels and help us build a category-defining company reshaping the broken and fragmented compliance and cybersecurity industry.

🎯 The Role

As an Application Security Engineer at Oneleet, you'll bring security depth to our product engineering teams as we expand our cybersecurity platform. You'll own the security judgment layer that sits between raw tooling output and what our customers actually see — deciding what to surface, what to suppress, and how to make findings genuinely useful rather than noisy.

✅ Key Responsibilities

• Own the integration, configuration, and output quality of security tooling that powers our platform
• Tune outputs to maximize signal and minimize noise — decide what to surface, what to suppress, and what to enrich
• Design rules, severity scoring, and triage flows that make findings actionable rather than overwhelming
• Build the security judgment layer on top of underlying tooling — context-aware prioritization and exploitability reasoning
• Partner with engineers on how findings are presented in the UI and how remediation flows work
• Work with PM and design on roadmap priorities, providing the security expertise that drives what to build next
• Review and shape architectural choices that affect security outcomes
• Engage with customers directly to understand how they use the platform and what's blocking adoption
• Benchmark our output quality against competitors and close gaps where they exist
• Contribute back to the open source security tooling we depend on where it makes sense

📌 Required Qualifications

• 5+ years of application security experience, with significant time shipping security products
• Strong programming skills in at least one of Go, Python, or TypeScript — this is a product engineering role with security depth, not security operations
• Hands-on experience tuning security tooling for production use — reducing false positives, building suppression logic, designing severity models
• Understanding of vulnerability research, CVE/CWE taxonomies, and exploit reasoning
• Has worked through what makes a security finding actually actionable vs. just technically true
• Excellent communication skills and comfort working directly with customers
• Pragmatic; knows how to build things fast without unnecessarily complicating things
• Experience in (and thrives in) a fast-moving, start-up engineering environment

⭐ Desirable Experience

• Prior experience shipping a security product at a vendor
• Contributions to open source security tooling
• Offensive security background or OSCP / similar certifications
• Hands-on experience with LLM agents, tool use, or autonomous AI systems

🎁 Benefits

Salary ranges are determined by role and by level, and within the range individual pay is determined by additional factors including job-related skills and experience. Total compensation includes salary + benefits + equity, however equity and benefits are not captured in this range. We hire talent globally and pay competitively based on where you live. The salary range listed reflects a US national baseline. If you're in a higher cost-of-labor market, your offer may land at or above the top of that range. If you're in another market, we'll benchmark your offer to local standards, which may be lower than the posted range.

🛂 Visa & Eligibility

We hire talent globally and pay competitively based on where you live.