About One

One’s mission is simple - to help customers achieve financial progress. We’re doing this by creating simple solutions to help our customers save, spend, borrow, and grow their money – all in one place.

The U.S. consumer today deserves better. Millions of Americans today can’t access credit, build savings or wealth, and are left to manage their financial lives through multiple disconnected apps. Almost a quarter of U.S. adults are unbanked or underbanked and roughly 80% of fintech users rely on multiple accounts to manage their finances.

What makes us unique? We are backed by a preeminent fintech investor (Ribbit) and the world’s largest retailer (Walmart), maintain the speed and independence of a startup, and employ a strong (and growing) collection of world-class talent.

There’s never been a better moment to build a business that helps people achieve financial progress. Come build with us!

The role

As an Application Security Engineer, you'll be responsible for ensuring that One delivers secure and reliable applications at scale. By partnering with engineers to build security into the product from the ground up, creating engineering tools and workflows that test and validate artifacts, and actively developing security frameworks, you’ll be the champion of modern Application Security Engineering at One and have a direct impact on the security of all of our products. You’ll provide subject-matter expertise to product teams regarding security best practices, optimize our secure coding practices, and use offensive security techniques to harden our environment and help improve our overall security practices.

This role is responsible for:

• Ensuring the quality and security of our applications and products by guiding their development through the Secure Development Lifecycle (SDLC) process.

• Performing SAST/DAST and penetration testing on core application services, web applications, and mobile applications.

• Developing, maintaining, and extending our in-house application security and penetration testing automated testing framework.

• Developing safe libraries and hardening existing libraries and frameworks to eliminate classes of vulnerabilities.

• Ensuring SDLC practices are enforced via Infrastructure-As-Code (IaC) policies, wherever possible

• Working closely with Engineering teams to validate the security posture of new features prior to production deployment

• Triaging and validating security vulnerabilities found or reported, and serving as a subject-matter expert in AppSec to the Engineering team in identifying and implementing mitigation solutions

• Refactoring and deploying secure libraries and frameworks across the code repository

• Training engineers, architects, code reviewers, and others on secure coding practices

• Contributing to application threat models

• Constantly maintaining awareness of known vulnerabilities in application technologies used within One

• Working with the Security and other engineering teams to maintain a security architecture that provides security controls throughout all platforms to mitigate risk, and to meet goals and regulatory requirements.

• Providing expertise around code-level security concerns during product development

You bring

• 4+ years of experience in security engineering, DevSecOps, and application development.

• Excellent knowledge of the CVSS, MITRE ATT&CK, and OWASP Top 10.

• Proficiency in TypeScript.

• Practical understanding of AWS and its core services (VPC, EC2, RDS).

• Demonstrated experience in modern application architecture and deployment practices.

• Experience with Library/API/Framework development.

• Experience with integrating security scanning tools with CI/CD, Web Application pentesting, fuzzing and DAST.

• Expertise in verifying and measuring common security vulnerabilities, and demonstrated ability to communicate these concepts to technical and non-technical partners.

• Exposure to most of the following technologies: AWS, iOS, Android, Vault, Kubernetes, PKI, React, GraphQL, and Datadog.

• Knowledge of cryptography including algorithms, standards, and their practical applications such as x.509 certificates.

• Experience defining security architecture patterns and standards.

• Proficiency in modern security evaluation tooling (Burp, Wireshark, Kali et al.)

• Preferably, understanding of regulatory compliance concerns (GLBA, CCPA, PCI).

• The Triple H Factor: Humble, Hungry and Honest.

Pay Transparency

The estimated annual