Application Security Engineer, Opal
Developing computer and network security for enterprises
Be an early applicant
Developing computer and network security for enterprises
21-100 employees
Be an early applicant
21-100 employees
Company mission
To accelerate a world where enterprises can adopt security best practices without slowing down.
Role
Who you are
- Have 4+ years in application security or software security engineering
- Actually write production code — findings reports are the floor, not the ceiling
- Know auth cold: OAuth 2.0, OIDC, SAML, session management, token lifecycle
- Are comfortable in AWS and containerized environments (Kubernetes, Docker)
- Bonus points for familiarity with our stack: Go, TypeScript, React, PostgreSQL, Redis, GraphQL
- Have led complex, cross-functional security initiatives from kickoff to completion
- Have run or participated in external pentests and seen findings through remediation
- Thrive on ownership and ambiguity — you'd rather write the playbook than wait for one
What the job involves
- Most security engineers spend their careers bolting locks onto doors that were already built. This is not that job
- We're hiring an Application Security Engineer to own security across Opal's product and platform — and yes, own means what it sounds like
- You'd be our dedicated security engineer, embedded directly with engineering, writing production code in Go and TypeScript, and building security into the product while it's still being designed
- You’ll work closely with a team of engineers that genuinely care about getting this right, and a product that happens to be one of the most security-critical tools in enterprise software
- Oh, and one more thing: Opal is a security company. We sell access control to organizations that take security seriously. That means your work isn't a cost center — it's core to what we do
- This role lives on the Platform team and partners closely with Infrastructure Engineering on cloud security. It is explicitly scoped to application and product security — enterprise IT, compliance, and vendor risk management are handled separately
- Own the secure SDLC end-to-end: threat modeling, design reviews, code reviews — you set the bar
- Run and coordinate app pentests (internal and external) and drive findings to closure
- Build and own SAST/DAST/SCA tooling wired into CI/CD so security ships with the code
- Triage and remediate vulnerabilities from every angle — bug bounty, internal scans, the works
- Build and maintain the security-critical stuff: encryption services, authz enforcement, authn flows
- Own the Auth0 ↔ Opal integration — tokens, sessions, MFA, SSO (SAML, OIDC, OAuth 2.0)
- Ship production Go and TypeScript to harden APIs, enforce least-privilege, and close vuln classes for good
- Create shared libraries that make the secure path the easy path for every product engineer
- Be first on the scene for security incidents: investigate, contain, find the root cause, fix it
- Partner with Infra on cloud hardening — AWS IAM, EKS, KMS, network segmentation
- Level up detection and response by writing detection rules and improving logging and alerting
- Mentor engineers on secure coding, common vuln patterns, and security architecture — you make the org smarter
- Help set the security roadmap by grounding it in real product risk
- Be the security teammate engineers want to work with — a collaborator, not a bottleneck
Our take
A platform focused on decentralising access management for enterprise customers, Opal is a company that offer businesses self-serve catalogues and identity management software to streamline workflows and access company data. In big businesses with large numbers of employees, cloud access can lead to a higher threat of security breaches, a problem that has plagued large companies like Amazon for years.
Opal combines its access management software with approval workflow solutions and customised app catalogues to help enterprises expand and keep secure.
Though it’s a competitive marketplace for security software development companies, Opal uses its founders' backgrounds in software engineering to help simplify the management of who accesses a company's data. Named a Rising in Cyber company 2024 on a list by Notable Capital, Opal has large-scale clients such as Databricks, Switchboard, Coinlist, and Merge under its belt as well as robust investors backing it.
Kirsty
Company Specialist at Welcome to the Jungle
Company
Funding (last 2 of 3 rounds)
Dec 2023
$22m
SERIES B
Jun 2022
$10m
SERIES A
Total funding: $33.8m
Company benefits
- Unlimited PTO + 10 company holidays
- Company stipend towards health, vision, and dental insurance
- Weekly meal plan for coffee and lunch
- Travel and mobile phone reimbursement
- 401k plan
Company HQ
Greenwich Village, New York, NY
Leadership
Umaimah Khan
(Co-Founder & CEO)Previously at Collective Health.
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job
View 10 more jobs at Opal