AppSec Engineer

Location

United States (Remote)

Full time

Remote

Engineering

• $170K – $210K

Pay is generally based upon the level, complexity, responsibility, location and job duties / requirements of the specific position. We then source candidates with the requisite skills, expertise, education, training, and experience. If you are selected for an interview, please feel welcome to speak to a Talent Partner about our compensation philosophy and other available benefits.

One Pay is an all-in-one financial platform driven by a simple mission: better money makes life better.

Tens of millions of Americans today are unbanked or underbanked, meaning they don’t have enough money in savings to cover a minor emergency. They pay too much in fees, don’t have access to credit at affordable rates, and have little ability to grow their wealth. One Pay’s vision is to create a single app for consumers to save, spend, borrow, and grow their money, bringing our mission to life with simple and accessible banking, credit, and payments products that deliver a best-in‑class experience to millions of customers.

Our products include:

• Checking and high-yield savings accounts
• Domestic and international peer‑to‑peer payments
• Credit Builder and credit score monitoring
• Digital wallet / contactless payment solutions
• Credit card program
• Buy‑now‑pay‑later installment loans at Walmart
• Prepaid mobile service

Why do we have a right to win? We have the backing of Walmart (a Fortune
1) and Ribbit Capital (a preeminent fintech investor), are deeply embedded with the distribution of the world’s largest omnichannel retailer, and have an industry‑leading multi‑product value proposition — all in addition to having some of the best people and talent in the industry.

There’s never been a better time to build a category‑defining business and there has rarely been a team better positioned for the opportunity. Join us!

Our Application Security Engineers play a pivotal role in safeguarding our platform, driving everything from designing secure AWS architectures to embedding automated threat detection that protects customer transactions. Your work will ensure we meet rigorous compliance standards (PCI, CCPA, GLBA) and maintain the highest levels of trust and reliability for our users.

• Architect and implement secure AWS configurations (IAM roles/policies, encryption keys, VPC segmentation)
• Embed security into CI/CD pipelines and repos using policy‑as‑code tools (pre‑commit hooks, SAST/SCA, IDE tool integrations)
• Secure container and orchestration environments (EKS, Kubernetes, Docker) per best practices
• Conduct threat modeling sessions and risk‑driven design reviews early in development
• Perform secure code reviews and static/dynamic analysis; oversee remediation with dev teams
• Automate repetitive security tasks—vulnerability triage, code scanning, tool orchestration
• Build and extend in‑house App Sec automation frameworks or pentest tooling
• Partner with security architecture and detection teams (SIEM tuning, logging, telemetry alignment)
• Develop and enforce App Sec standards and patterns across product teams; iterate through feedback loops
• Support regulatory or compliance assessments (PCI, CCPA, GLBA) as needed

• 8–12 years’ experience in application security engineering, Dev Sec Ops , or security platform engineering
• Deep familiarity with CVSS, MITRE ATT&CK frameworks, OWASP Top 10 and CWE taxonomy
• Proven experience with AWS core services: IAM, KMS, VPC, EC2, RDS, EKS
• Hands‑on expertise in securing IaC and CI/CD pipelines; strong knowledge of policy‑as‑code tooling
• Container security experience:
  Docker, Kubernetes, EKS‑related threat surfaces
• Solid threat modeling and secure code review skills; SAST/SCA tool proficiency
• Experience scripting automation (e.g. Python, Bash, Power Shell) to streamline App Sec tasks
• Capability to lead in‑house App Sec frameworks or tooling development
• Strong communicator, able to translate technical findings to non‑technical stakeholders
• Track record of defining and institutionalizing security architecture patterns

We use Node and Type Script on the server, leveraging the…