Application Security Engineer
Posted 20 May 2026
BranchFactor Summary
The original posting with the fluff stripped out
- Expected experience
- 4+ yrs
- Management level
- Individual contributor
- Employment
- Hybrid
- Contract
- Full-time
No salary listed for this role.
About Opal Security:
At Opal, we’re building modern identity governance for the AI era—intelligent access management that empowers enterprises to move fast while staying secure. Our mission is to bring clarity, control, and confidence to complex enterprise environments, helping teams govern access without slowing down innovation.
The Role:
Most security engineers spend their careers bolting locks onto doors that were already built. This is not that job.
We're hiring an Application Security Engineer to own security across Opal's product and platform — and yes, own means what it sounds like. You'd be our dedicated security engineer, embedded directly with engineering, writing production code in Go and TypeScript, and building security into the product while it's still being designed. You’ll work closely with a team of engineers that genuinely care about getting this right, and a product that happens to be one of the most security-critical tools in enterprise software.
Oh, and one more thing: Opal is a security company. We sell access control to organizations that take security seriously. That means your work isn't a cost center — it's core to what we do.
This role lives on the Platform team and partners closely with Infrastructure Engineering on cloud security. It is explicitly scoped to application and product security — enterprise IT, compliance, and vendor risk management are handled separately.
What You’ll Do:
Secure Development Lifecycle -
-
Own the secure SDLC end-to-end: threat modeling, design reviews, code reviews — you set the bar
-
Run and coordinate app pentests (internal and external) and drive findings to closure
-
Build and own SAST/DAST/SCA tooling wired into CI/CD so security ships with the code
-
Triage and remediate vulnerabilities from every angle — bug bounty, internal scans, the works
Software Security Engineering -
-
Build and maintain the security-critical stuff: encryption services, authz enforcement, authn flows
-
Own the Auth0 ↔ Opal integration — tokens, sessions, MFA, SSO (SAML, OIDC, OAuth 2.0)
-
Ship production Go and TypeScript to harden APIs, enforce least-privilege, and close vuln classes for good
-
Create shared libraries that make the secure path the easy path for every product engineer
Incident Response & Cloud Security -