Application Security Engineer: Automate & Secure SDLC

OneStream Software; Birmingham (MI); On-site; USD 114,000 - 148,000; Full time

Benefits offered by this job

Excellent Medical Plan

Dental & Vision Insurance

Life Insurance

Retirement Plan

Vacation Time

Professional Development

Job summary

OneStream Software is seeking an Application Security Engineer to strengthen the security of our platform. You will triage findings from SAST, SCA, and DAST, work with engineering teams on practical remediation, and contribute to security design reviews and threat modelling throughout the SDLC.

You should have a solid software development background, be comfortable with C#/.NET, and be capable of explaining technical details to both technical and non-technical audiences.

Qualifications

• 5+ years in application security, software development, or DevSecOps.
• Master's degree adds 1+ year experience requirement; or 1+ year with MSc/MA.
• Associates + 5+ years experience accepted as alternative.

Responsibilities

• Triage and validate findings from SAST, SCA, and DAST.
• Remediate vulnerabilities with clear, practical guidance.
• Participate in security architecture reviews and threat modelling.
• Integrate and tune security tooling in CI/CD pipelines.
• Use AI-assisted tools to automate repetitive tasks and reporting.
• Write scripts to automate recurring security workflows.
• Review SDLC and software supply chain for security improvements.
• Perform targeted manual validation of findings as needed.
• Track remediation progress and document security trends.
• Contribute to secure development guidance and education.

Skills

SAST

SCA

DAST

C#

.NET

CI/CD

Python

PowerShell

AI tooling

Threat modelling

Communication

Education

Bachelor's in Computer Science/Engineering

Master's in Computer Science/Engineering

Associates in CS/Engineering

Tools

Burp Suite

Jenkins

Git

Job description

OneStream Software is seeking an Application Security Engineer to strengthen the security of our platform. You will triage findings from SAST, SCA, and DAST, work with engineering teams on practical remediation, and contribute to security design reviews and threat modelling throughout the SDLC.

You should have a solid software development background, be comfortable with C#/.NET, and be capable of explaining technical details to both technical and non-technical audiences.