4 months ago
Toronto, CanadaSenior
Responsibilities
- Define, build, and operate application vulnerability identification, triage, and remediation capabilities across consumer products, internal tools, and GraphQL APIs.
- Assess and manage AppSec tooling for static and dynamic testing, software supply chain risk detection, and secrets scanning, integrating findings into GitHub, Linear, and Slack workflows.
- Own and mature the HackerOne bug bounty program and improve report triage, researcher relationships, and remediation follow-through.
- Lead threat modeling and security design reviews for services, APIs, and mobile features, and convert recurring patterns into rules, lint checks, and CI guardrails.
- Build AI agents and automated workflows for vulnerability triage, exploit validation, and remediation pull requests.
- Partner with engineering teams to improve authentication, authorization, input validation, GraphQL gateway security, and Kubernetes workload security.
- Build offensive security capabilities through internal security testing, red team exercises, and adversarial analysis.
- Establish secure-by-default standards for AI-enabled applications, MCP servers, and agent-driven workflows.
- Develop security design standards, participate in engineering rituals, and strengthen the organization’s security culture.
Requirements
- 5+ years of application security or software engineering experience with a security focus.
- Strong programming skills in at least one of Python, Go, TypeScript, or Ruby, with the ability to read and write the others.
- Track record of building agentic systems that replace reactive security work and manual processes.
- Hands-on deployment experience with GitHub Advanced Security, Semgrep, or equivalent security risk detection tools.
- Strong understanding of application and API vulnerability classes, including GraphQL, REST, and gRPC security issues.
- Practical threat modeling and security design review experience.
- Experience with AWS and Kubernetes cloud and container security, including identity and access management, secrets management, and CI/CD pipeline security.
- Experience with offensive security, penetration testing, API security, mobile security, red team operations, bug bounty programs, AI or machine learning pipeline security, agent frameworks, or MCP-style integrations is preferred.
- OSCP, OSWE, or similar offensive security certification is a bonus.
- Humility, curiosity, autonomy, and a business-enablement approach to security are expected.
Benefits
- Based in Opendoor’s downtown Toronto office.
- In-person work is required four days per week: Monday, Tuesday, Thursday, and Friday.
- Candidates must live within commuting distance of the Toronto office.
Tech Stack
Categories
About Opendoor
Opendoor builds a digital platform for buying and selling homes, offering instant cash offers to sellers and self-serve tools for buyers to tour and purchase. The company makes money by purchasing homes, reselling them, and providing related real estate services. Founded in 2014 and headquartered in San Francisco, Opendoor is a public company traded on NASDAQ (OPEN) and operates across many U.S. housing markets.