Application Security Engineer
About the role
Hands-on security-first engineering role at a Series A startup. Own the security judgment layer between tooling output and customer-facing findings, working closely with backend/frontend engineers, product, design, and customers to surface actionable security insights.
Responsibilities
- Own the integration, configuration, and output quality of security tooling that powers our platform
- Tune outputs to maximize signal and minimize noise — decide what to surface, what to suppress, and what to enrich
- Design rules, severity scoring, and triage flows that make findings actionable rather than overwhelming
- Build the security judgment layer on top of underlying tooling — context-aware prioritization and exploitability reasoning
- Partner with engineers on how findings are presented in the UI and how remediation flows work
- Work with PM and design on roadmap priorities, providing the security expertise that drives what to build next
- Review and shape architectural choices that affect security outcomes
- Engage with customers directly to understand how they use the platform and what's blocking adoption
- Benchmark our output quality against competitors and close gaps where they exist
- Contribute back to the open source security tooling we depend on where it makes sense
Qualifications
- 5+ years of application security experience, with significant time shipping security products
- Strong programming skills in at least one of Go, Python, or TypeScript — this is a product engineering role with security depth, not security operations
- Hands-on experience tuning security tooling for production use — reducing false positives, building suppression logic, designing severity models
- Understanding of vulnerability research, CVE/CWE taxonomies, and exploit reasoning
- Has worked through what makes a security finding actually actionable vs. just technically true
- Excellent communication skills and comfort working directly with customers
- Pragmatic; knows how to build things fast without unnecessarily complicating things
- Experience in (and thrives in) a fast-moving, start-up engineering environment
Skills
Benefits
- Comprehensive health & wellness benefits
- 20 days PTO per year, plus 8 floating holiday
- Remote work culture
- Team off-sites in stunning places (Amsterdam, Italy, etc)
- Competitive compensation & equity
About Oneleet
YC's most popular security compliance platform (SOC 2, ISO 27001,…
Oneleet helps companies become secure and compliant through an all-in-one solution that combines automated tools and human expertise. Oneleet has built the second generation of security compliance automation software, providing tools that go beyond what is classically provided for just compliance alone. Tools like a code security scanner, attack-surface management, access reviews and trust portal are all built in. As the most popular, highest rated and most frequently used platform in the YC community, Oneleet has quickly established itself as the preferred and superior alternative to other incumbents. The founder behind Oneleet has spent the past 10+ years helping companies become more secure by performing penetration tests.
More open roles at Oneleet
- Customer Support Specialist4d agoUS/LATAM - Remote · Customer Success
- Community Event & Engagement Manager - San Francisco, CA2w agoHybrid (San Francisco, CA) · Marketing
- Security Program Manager - LATAM4w agoLATAM - Remote · Security/Compliance
- GTM AI Engineer - Data & Attribution2mo agoUS/EU - Remote · Operations
- Security Program Manager3mo agoRemote · Operations