Application Security Engineer

OneStream Software; Birmingham (MI); On-site; USD 114,000 - 148,000; Full time

Benefits offered by this job

Excellent Medical Plan

Dental & Vision Insurance

Life Insurance

Retirement Plan

Vacation Time

Professional Development

Job summary

OneStream Software is seeking an Application Security Engineer to strengthen the security of our platform. You will triage findings from SAST, SCA, and DAST, work with engineering teams on practical remediation, and contribute to security design reviews and threat modelling throughout the SDLC.

You should have a solid software development background, be comfortable with C#/.NET, and be capable of explaining technical details to both technical and non-technical audiences.

Qualifications

• 5+ years in application security, software development, or DevSecOps.
• Master's degree adds 1+ year experience requirement; or 1+ year with MSc/MA.
• Associates + 5+ years experience accepted as alternative.

Responsibilities

• Triage and validate findings from SAST, SCA, and DAST.
• Remediate vulnerabilities with clear, practical guidance.
• Participate in security architecture reviews and threat modelling.
• Integrate and tune security tooling in CI/CD pipelines.
• Use AI-assisted tools to automate repetitive tasks and reporting.
• Write scripts to automate recurring security workflows.
• Review SDLC and software supply chain for security improvements.
• Perform targeted manual validation of findings as needed.
• Track remediation progress and document security trends.
• Contribute to secure development guidance and education.

Skills

SAST

SCA

DAST

C#

.NET

CI/CD

Python

PowerShell

AI tooling

Threat modelling

Communication

Education

Bachelor's in Computer Science/Engineering

Master's in Computer Science/Engineering

Associates in CS/Engineering

Tools

Burp Suite

Jenkins

Git

Job description

At OneStream, we're on a mission to empower every Finance organization and professional to exceed their potential. Our global teams span continents, cultures, and time zones, united by a shared purpose as we build the operating system for modern Finance and help organizations move with greater speed, clarity, and confidence.

That mission comes to life through our people. Behind every innovation, customer success, and milestone are talented people working together to make a difference. That's why we're looking for people who are bold enough to think big, authentic in how they lead and collaborate, curious about what's possible, and committed to delivering results.

Summary

We are looking for an Application Security Engineer to join the Information Security team. In this role, you will help keep the OneStream platform secure by triaging and validating findings from application security tools, partnering with engineering teams on practical remediation, and supporting security design reviews and threat modelling for new features throughout the SDLC. You will also use automation and AI-assisted tooling to take on repetitive work, such as reviewing and summarizing findings, so the team can focus on higher-impact security problems.

The ideal candidate has experience in software engineering and security, with a solid foundation in secure development practices, familiarity with application security tools (SAST, SCA, and DAST), and a passion for securing our platform for our customers. Working knowledge of C# and .NET is a bonus. We are looking for a go-getter who is eager to learn, collaborates well with teams across all levels of the organization, and brings a pragmatic approach to security that keeps delivery moving. This position requires the ability to explain and discuss technical details with both technical and non-technical audiences.

Primary Duties and Responsibilities

• Triage and validate findings from application security tools (SAST, SCA, and DAST), prioritizing by exploitability and real-world risk.
• Partner with Development and Engineering teams to remediate vulnerabilities with clear, practical guidance.
• Participate in security architecture reviews and threat modelling for new features and services.
• Integrate and tune application security tooling in CI/CD pipelines so security checks fit naturally into developer workflows.
• Use AI-assisted tools and automation to streamline repetitive tasks such as reviewing and summarizing findings, removing duplicates and false positives, creating tickets, and reporting.
• Write scripts and lightweight tooling to automate recurring security workflows.
• Review the SDLC and software supply chain, including third-party dependencies, to identify opportunities to improve security.
• Perform targeted manual validation of findings when needed to confirm impact.
• Track remediation progress, and document and report security concerns and trends.
• Contribute to secure development guidance, standards, and developer education.
• Work with other members of the Security team to share findings and improve overall security posture.

Required Education and Experience

• BSc/BA in Computer Science, Engineering, or relevant field, with 5+ years of experience in application security, software development, or DevSecOpsOR
• MSc/MA in Computer Science, Engineering, or relevant field, with 1+ year of experience in application security, software development, or DevSecOpsOR
• Assoc. in Computer Science, Engineering, or relevant field, with 5+ years of experience in application security, software development, or DevSecOps

Preferred Education and Experience

• Experience writing or reviewing C# & .NET code (a strong plus).
• Software development background, with an understanding of secure coding practices and common vulnerability classes (e.g., OWASP Top 10).
• Hands-on experience with SAST, SCA, and/or DAST tools and triaging their output.
• Experience using AI tools or LLMs to automate repetitive work, such as reviewing findings, summarizing results, or drafting remediation guidance.
• Experience with CI/CD pipelines and DevSecOps practices.
• Scripting or automation experience (e.g., Python, PowerShell).
• Familiarity with threat modelling methodologies (e.g., STRIDE).
• Exposure to Burp Suite or similar tools for validating web application findings.
• Familiarity with security risk management, SOC2, FedRAMP, security policies & procedures, or security auditing.
• Any industry recognized certifications, for example:
  • CompTIA Security+
  • Certified Secure Software Lifecycle Professional (CSSLP)
  • GIAC Secure Software Programmer - .NET (GSSP-.NET)
  • Other application security or secure development certifications
  • Outstanding communication skills

Knowledge, Skills, and Abilities

• Ability to triage and prioritize security findings based on exploitability and business impact.
• Working knowledge of application security tools such as SAST, SCA, and DAST.
• Understanding of secure design principles, with the ability to contribute to security architecture reviews and threat modelling.
• Enthusiasm for using AI and automation to reduce repetitive manual work.
• Collaborative and pragmatic, with the judgement to fit security into how teams already work.
• Go-getter: self-motivated, self-starter, and eager to learn.
• Organized, with strong reasoning skills and good judgement.
• Ability to multitask and prioritize a variety of projects.
• Comfortable communicating with all levels of management.
• Experience with OneStream Software not required, but experience with any financial consolidation package is a plus.

Benefits at OneStream

OneStream employees are passionate, hardworking individuals who go above and beyond to keep our customers happy and follow through on our mission statement. They consistently deliver the best and in turn, we make every effort to keep them cared for and happy. A sample of the benefits we provide are:

• Excellent Medical Plan
• Dental & Vision Insurance
• Life Insurance
• Short & Long Term Disability
• Vacation Time
• Paid HolidaysProfessional Development
• Retirement Plan

Total compensation is based on experience, skills, and location using objective, job-related criteria. Additional variable compensation and benefits may apply.

Gross annual base salary

$114,000 — $148,000 USD

All candidates must be legally authorized to work for any company in the country where this position is located without sponsorship.

OneStream Software is an equal opportunity employer.

All qualified applicants will receive consideration for employment without regard to race,color, religion, sex (including pregnancy, sexual orientation, or gender identity), national origin, age, disability, genetic information, veteran status, or any other characteristic protected by applicable local laws, regulations, and ordinances.

If you need assistance and/or a reasonable accommodation during the application process, reach out to [e-mail].

OneStream may use the personal information you provide to process your application and contact you,in accordance withapplicable privacy laws such as the CCPA and GDPR. For more information about how we handle your personal information, please review OneStream's Privacy Policy.