Application Security Engineer

● Languages: Go, Python, TypeScript, Ruby, Terraform

● Cloud: AWS, GCP, Azure, Kubernetes, Apollo GraphQL

● AppSec Tooling: GitHub Advanced Security (CodeQL, Dependabot, secret scanning), Semgrep, HackerOne, Burp Suite, Cloudflare WAF

● AI Tooling: Claude, OpenAI, various agent frameworks, MCP — used heavily for vulnerability triage, exploit verification, and remediation drafting

● Deep conviction that AI and automation should eliminate manual work and increase the team's impact, and a track record to prove it. You’ve built agentic systems that replaced reactive security work, not just configured off-the-shelf tools.

● Comfort operating with high autonomy in ambiguous environments. You’ve defined what “good” looks like in a domain where no playbook existed, you’re energized by that, not unsettled by it.

● Business enablement security mindset. You measure success by business impact and informed risk-taking, not by tickets opened or pen test reports filed.

● 5+ years of application security or software engineering experience with a security focus, with strong skills in at least one of Python, Go, TypeScript, or Ruby, and the ability to read and write code across the others.

● Hands-on expertise across the security risk detection toolchain with real deployment experience using GitHub Advanced Security, Semgrep, or equivalent.

● Strong grasp of common application and API vulnerability classes including GraphQL, REST, and gRPC security pitfalls - broken authorization, mass assignment, introspection exposure, insecure direct object references.

● Practical threat modeling skills. You can take an architecture diagram and a 30-minute conversation and walk out with the three things that actually matter.

● Experience with cloud and container security on AWS and Kubernetes, including identity and access management, secrets management, and continuous integration / continuous deployment pipeline security.

● Humility and genuine curiosity. You're as excited to learn from product engineers and enable their work as you are to break things.

● Offensive security experience including pentesting, API security, or mobile security, and/or red team operations.

● Experience running a bug bounty or coordinated disclosure program at scale.

● Mobile application security review experience (iOS and Android).

● Experience securing AI and machine learning pipelines, agent frameworks, or MCP-style integrations.

● OSCP, OSWE, or similar offensive certifications.

At Opendoor our mission is to tilt the world in favor of homeowners and those who aim to become one. Homeownership matters. It's how people build wealth, stability, and community. It's how families put down roots, how neighborhoods strengthen, how the future gets built. We're building the modern system of homeownership giving people the freedom to buy and sell on their own terms. We’ve built an end-to-end online experience that has already helped thousands of people and we’re just getting started.