4 months ago
Responsibilities
- Define, build, and operate application vulnerability identification, triage, and remediation capabilities across consumer products, internal tools, and GraphQL APIs.
- Assess and operate AppSec tooling for static and dynamic testing, software supply-chain risk detection, and secrets scanning, integrating findings into GitHub, Linear, and Slack workflows.
- Own and mature the HackerOne bug bounty program, including report triage, researcher relationships, and remediation follow-through.
- Lead threat modeling and security design reviews for services, APIs, and mobile features, converting findings into rules, lint checks, and CI guardrails.
- Build AI agents and automated workflows for vulnerability triage, exploit validation, and remediation pull-request drafting.
- Partner with engineering teams to harden authentication, authorization, input validation, GraphQL services, and Kubernetes workloads.
- Build offensive security capabilities through internal testing, red-team exercises, and adversarial analysis.
- Establish secure-by-default standards for AI-enabled applications, MCP servers, and agent-driven workflows.
- Develop secure design standards, participate in engineering rituals, and strengthen the organization’s security culture.
Requirements
- 5+ years of application security or software engineering experience with a security focus.
- Strong programming skills in at least one of Python, Go, TypeScript, or Ruby, with the ability to read and write code across the others.
- Hands-on deployment experience with GitHub Advanced Security, Semgrep, or equivalent security risk detection tooling.
- Strong understanding of application and API vulnerability classes, including GraphQL, REST, and gRPC security issues.
- Practical threat modeling and security design review experience.
- Experience with cloud and container security on AWS and Kubernetes, including identity and access management, secrets management, and CI/CD pipeline security.
- Demonstrated experience building agentic systems and automation that replace reactive security work.
- Ability to operate autonomously in ambiguous environments and apply a business-enablement security mindset.
- Preferred experience with penetration testing, API or mobile security, red-team operations, bug bounty or coordinated disclosure programs, mobile application security, AI/ML pipeline security, agent frameworks, or MCP integrations.
- OSCP, OSWE, or similar offensive security certification is a bonus.
Benefits
- The role is based in Opendoor’s downtown Miami office and requires in-person work four days per week: Monday, Tuesday, Thursday, and Friday.
- Candidates must live within commuting distance of the Miami office.
Tech Stack
Categories
About Opendoor
Opendoor builds a digital platform for buying and selling homes, offering instant cash offers to sellers and self-serve tools for buyers to tour and purchase. The company makes money by purchasing homes, reselling them, and providing related real estate services. Founded in 2014 and headquartered in San Francisco, Opendoor is a public company traded on NASDAQ (OPEN) and operates across many U.S. housing markets.