Application Security Engineer, ONE
$175-205k
+ Stock options
Ethical personal finance platform
Open for applications
Ethical personal finance platform
501-1000 employees
Open for applications
$175-205k
+ Stock options
501-1000 employees
Company mission
To help people live healthier financial lives.
Role
Who you are
- 4+ years of experience in security engineering, DevSecOps, and application development
- Excellent knowledge of the CVSS, MITRE ATT&CK, and OWASP Top 10
- Proficiency in TypeScript
- Practical understanding of AWS and its core services (VPC, EC2, RDS)
- Demonstrated experience in modern application architecture and deployment practices
- Experience with Library/API/Framework development
- Experience with integrating security scanning tools with CI/CD, Web Application pentesting, fuzzing and DAST
- Expertise in verifying and measuring common security vulnerabilities, and demonstrated ability to communicate these concepts to technical and non-technical partners
- Exposure to most of the following technologies: AWS, iOS, Android, Vault, Kubernetes, PKI, React, GraphQL, and Datadog
- Knowledge of cryptography including algorithms, standards, and their practical applications such as x.509 certificates
- Experience defining security architecture patterns and standards
- Proficiency in modern security evaluation tooling (Burp, Wireshark, Kali et al.)
- Preferably, understanding of regulatory compliance concerns (GLBA, CCPA, PCI)
- The Triple H Factor: Humble, Hungry and Honest
What the job involves
- As an Application Security Engineer, you'll be responsible for ensuring that One delivers secure and reliable applications at scale
- By partnering with engineers to build security into the product from the ground up, creating engineering tools and workflows that test and validate artifacts, and actively developing security frameworks, you’ll be the champion of modern Application Security Engineering at One and have a direct impact on the security of all of our products
- You’ll provide subject-matter expertise to product teams regarding security best practices, optimize our secure coding practices, and use offensive security techniques to harden our environment and help improve our overall security practices
- Ensuring the quality and security of our applications and products by guiding their development through the Secure Development Lifecycle (SDLC) process
- Performing SAST/DAST and penetration testing on core application services, web applications, and mobile applications
- Developing, maintaining, and extending our in-house application security and penetration testing automated testing framework
- Developing safe libraries and hardening existing libraries and frameworks to eliminate classes of vulnerabilities
- Ensuring SDLC practices are enforced via Infrastructure-As-Code (IaC) policies, wherever possible
- Working closely with Engineering teams to validate the security posture of new features prior to production deployment
- Triaging and validating security vulnerabilities found or reported, and serving as a subject-matter expert in AppSec to the Engineering team in identifying and implementing mitigation solutions
- Refactoring and deploying secure libraries and frameworks across the code repository
- Training engineers, architects, code reviewers, and others on secure coding practices
- Contributing to application threat models
- Constantly maintaining awareness of known vulnerabilities in application technologies used within One
- Working with the Security and other engineering teams to maintain a security architecture that provides security controls throughout all platforms to mitigate risk, and to meet goals and regulatory requirements
- Providing expertise around code-level security concerns during product development
Our take
Banks have a poor image and are often perceived to not care about their customers. ONE Finance has the financial well-being of its clients at the heart of what it does. Offering equal access to high-yield savings rates and affordable credit that grows. Its signature feature is the ability to organize money in multiple sub-accounts that ONE calls “Pockets,” whether to pay specific bills or save toward goals. You can also set up shared “Pockets” with partners or friends for joint saving objectives.
ONE is part of a new wave of digital banking apps that have the potential to disrupt traditional legacy systems, driven by European firms such as Triodos in the Netherlands. ONE Finance is clear that it doesn’t use deposits for anything that exploits the Earth's resources or is involved in the arms trade, setting it apart from other recent endeavours from Monzo and Revolut who aren’t so forthcoming about where its funds are invested.
In 2022, ONE was acquired by Hazel, a FinTech company which was launched by Walmart and Ribbit Capital and which also acquired Even Responsible Finance at the same time. The companies have merged under the ONE brand, combining workforces, products and operating budgets, and will benefit from Walmart's support and marketing reach.
Freddie
Company Specialist at Welcome to the Jungle
Insights
Few candidates hear
back within 2 weeks
68% employee growth in 12 months
Company
Funding (last 2 of 3 rounds)
Aug 2021
$40m
SERIES B
Mar 2020
$17m
SERIES A
Total funding: $66m
Company benefits
- Benefits effective on day one
- Early access to a high potential, high growth fintech
- Generous stock option packages in an early-stage startup
- Remote friendly (anywhere in the US) and office friendly - you pick the schedule
- Flexible time off programs - vacation, sick, paid parental leave, and paid caregiver leave
- 401(k) plan with match
Company HQ
Civic Center, New York, NY
Articles
Leadership
Brian Hamilton
(Chief Commercial Officer)Started their career at Wells Fargo Foreign Exchange before leaving after almost 8 years to join Clear2Pay in 2006. They founded Isomer Labs, PushPoint, and Azlo before starting One as CEO in February 2019.
Share this job
View 16 more jobs at ONE