Senior Security Analyst

opensesame; United States; Remote; USD 120,000 - 190,000; Full time

Job summary

OpenSesame is seeking a Senior Security Analyst to strengthen its security posture in a fast-growing environment. You will own penetration testing programs, build vulnerability management systems, and drive security automation across cloud, AI, and applications.

You will partner with Engineering, DevOps, IT, and Compliance to embed security into every stage of development and operations, supporting audit readiness and risk reduction.

Qualifications

• Deep technical security expertise.
• Experience leading penetration testing programs.
• Ability to build vulnerability management systems and automation.

Responsibilities

• Develop a comprehensive view of the external attack surface, vulnerabilities, and threat landscape.
• Own external penetration testing engagements end-to-end, including scope and remediation validation.
• Build and operate a structured vulnerability management program with DevOps, Engineering, and IT.
• Stand up scalable evidence collection and control-mapping workflows in Drata for audit readiness.
• Embed security into engineering, infrastructure, and IT workflows from the outset.
• Design and implement a continuous penetration testing program leveraging automation and threat modeling.
• Lead the bug bounty program, improving signal quality and remediation workflows.
• Drive AI security practices across internal systems and product development, including ISO-related controls.
• Develop automations to collect threat intelligence and detect drift across cloud and SaaS platforms.
• Improve Jira/Confluence workflows to create visibility and accountability for findings.

Skills

Penetration testing

Vulnerability management

Security automation

Cloud security

Application security

Audit readiness

AI security

Cross-functional collaboration

Job description

About OpenSesame

OpenSesame is the trusted partner for Workforce Reinvention in the age of AI. OpenSesame delivers integrated software, curated and customizable content, and expert services - embedded into existing learning, HR, and work systems - to help organizations expand their human+AI potential and thrive through change.

Learn more: www.opensesame.com/about

About the Role

As a Senior Security Analyst on our Compliance team, you will play a key role in strengthening OpenSesame's security posture in a fast-moving, high-growth environment. We're looking for someone who brings deep technical security expertise, a proactive mindset, and the ability to turn complex risks into practical, scalable solutions.

This role spans vulnerability management, penetration testing, bug bounty operations, cloud and application security, and audit readiness. You'll partner across Engineering, DevOps, IT, and Compliance to improve security processes, support compliance efforts, and help ensure security is built into how we work, especially as we continue evolving our approach to AI security. We're looking for proven examples from your career that show you can do this job; that you've owned penetration testing programs, built vulnerability management systems, implemented security automation, and helped organizations adopt modern technologies (including AI) securely and responsibly.

You’ll be a strong fit if you're detail-oriented, collaborative, and excited to build programs that reduce risk, improve visibility, and support safe innovation across the business.

Performance Objectives

Establish Security Ownership & Technical Depth (0-6 Months)

• Develop a comprehensive view of OpenSesame's external attack surface, vulnerabilities, and threat landscape - integrating signals from CrowdStrike, cloud environments (AWS, GCP), and application security tooling.
• Own external penetration testing engagements end-to‑end - including vendor selection, scope design, execution oversight, remediation validation, and executive reporting.
• Build and operationalise a structured vulnerability management program - pairing with DevOps, Engineering, and IT to prioritize and remediate risk effectively.
• Stand up scalable evidence collection and control mapping workflows in Drata - improving audit readiness and reduced manual effort.
• Establish strong cross‑functional relationships to embed security into engineering, infrastructure, and IT workflows from the outset.

Operationalise Continuous & AI‑Aware Security (6-12 Months)

• Design and implement a continuous penetration testing programme that complements annual third‑party testing - leveraging automation, threat modeling, and targeted validation.
• Own and mature the bug bounty program - improving signal quality, triage processes, researcher engagement, and remediation workflows.
• Lead implementation of AI security practices across internal systems and product development:
  • Apply OWASP Top 10 for LLMs / AI systems to identify and mitigate emerging risks
  • Support adoption and operationalization of ISO 42001 controls
  • Define secure usage patterns for internal AI tools and third‑party AI integrations
  • Partner with Product Engineering to define and enforce secure AI and application baseline requirements - ensuring security is built into system design, not retrofitted.
• Develop automations and tooling (Python, APIs, Make) to continuously collect threat intelligence, validate security baselines, and detect drift across AWS, GCP, GitHub, and SaaS platforms.
• Improve Jira and Confluence workflows to create visibility, accountability, and measurable progress across security findings and remediation.
• Provide deep technical support during audits - translating real‑world implementations into clear, defensible narratives aligned with ISO 27001, ISO 27701, and ISO 42001.

Drive Security Maturity & Compliance Integration (12+ Months)

• Serve as a senior technical partner to Compliance - supporting vendor reviews, customer security questionnaires, and control design with practical, implementation‑level expertise.
• Continuously improve Drata automation and evidence pipelines - moving toward near real‑time compliance visibility.
• Partner with Engineering and DevOps leadership to evolve secure development practices, CI/CD security controls, and cloud security baselines.
• Establish and refine AI security governance models - balancing innovation with risk management across internal and customer‑facing use cases.
• Identify systemic risks, recurring vulnerability patterns, and process inefficiencies - driving durable, organization‑wide improvements.
• Contribute to long‑term security strategy - aligning threat management, AI adoption, compliance requirements, and engineering velocity.

What Success Looks Like

Penetration testing (external and continuous) is predictable, effective, and drives measurable reductions in risk.

Vulnerabilities are prioritized intelligently and remediated within defined SLAs, with clea