Application Security Engineer

About Onebrief

Onebrief is collaboration and AI-powered workflow software designed specifically for military staffs. By transforming this work, Onebrief makes the staff as a whole superhuman - meaning faster, smarter, and more efficient.

We take ownership, seek excellence, and play to win with the seriousness and camaraderie of an Olympic team. Onebrief operates as an all-remote company, though many of our employees work alongside our customers at military commands around the world.

Founded in 2019 by a group of experienced planners, today, Onebrief’s team spans veterans from all forces and global organizations, and technologists from leading-edge software companies. We’ve raised $123m+ from top-tier investors, including Battery Ventures, General Catalyst, Insight Partners, and Human Capital, and today, Onebrief is valued at $1.1B. With this continued growth, Onebrief is able to make an impact where it matters most.

Security Clearance, Location, and Onsite Notice:

This role is remote. The role may require occasional (once per quarter or less) on-site activities at customer locations.

Must be a US Citizen, eligible for a Secret Security Clearance. Active Secret or Top Secret Clearance is a plus, SCI eligibility is a plus.

About The Role

We are hiring an Application Security Engineer to join our Infrastructure & Security team. You’ll report to our Director of Infrastructure and work closely with fellow SREs, Software Engineers, DevOps Engineers, Platform Engineers, Customer Relations, and Cybersecurity Analysts.

You will be helping identify, triage and fix security issues within the Onebrief application and related platform and deployed infrastructure.

About You

You are a security-minded individual who knows that vulnerabilities in modern software are an existential business risk. Maybe you love reading incident reports, and perhaps you even participate in security conferences like DefCon or OWASP meetups. Ideally, you have experience in a related field like software engineering, DevOps or systems administration. You are familiar with modern cloud-native technologies like Kubernetes and have experience with software development. Maybe you have experience with game cheat development/detection, bug bounties, or maybe you come from a traditional enterprise security background.

What You’ll Do

You will own the security and compliance posture of our software products and platform. You will do this by:

• Find Vulnerabilities in our Software: Bring an attacker’s mindset to review PRs, perform code audits, and utilize static analysis to identify vulnerable code patterns that can be exploited by adversaries. Use dynamic analysis, fuzzers and code reviews to find weaknesses in our codebase and work with developers to patch them.

• Fix Vulnerabilities Across the Full Stack: Think like an adversary to find, fix, prevent or patch vulnerabilities from browser to kernel. Utilize vulnerability scanners to find unpatched components, and identify configuration errors that could expose our deployments to an attacker. Work with platform engineers to harden our customer environments and utilize best practices. Advise on network configuration, identity and access management and infrastructure security.

• Improve the Security Posture of Infrastructure: Review identity and access management, logging, auditing, monitoring to help craft a layered defense for our corporate infrastructure and customer environments. Work with Cybersecurity analysts to help ensure compliance with corporate/Federal standards like SOC II, NIST and FedRamp Moderate/High.

• Make the Team Stronger: Mentor other engineers on best security practices, share news of vulnerable libraries and compromises, engage with community on active threats and trends in exploit development, malware, etc. Work to improve processes to shift security “left” and identify vulnerabilities earlier in the design, development and deployment of our software.

What we look for:

Experience & collaboration

• 5+ years of experience in Application Security, Cybersecurity Engineering, Software Engineering or a related field, preferably with first-hand experience ensuring security in high-compliance environments like PCI DSS, HIPAA or NIST.

• U.S. citizenship required, security clearance greatly desired.

• A strong understanding of Linux, containerization and orchestration, and virtual machines

• Networking fundamentals: core protocols and secure configurations.

• A deep understanding of incident response processes, with experience conducting thorough root cause analyses and driving continuou