About One

One’s mission is simple - to help customers achieve financial progress. We’re doing this by creating simple solutions to help our customers save, spend, borrow, and grow their money – all in one place.

The U.S. consumer today deserves better. Millions of Americans today can’t access credit, build savings or wealth, and are left to manage their financial lives through multiple disconnected apps. Almost a quarter of U.S. adults are unbanked or underbanked and roughly 80% of fintech users rely on multiple accounts to manage their finances.

What makes us unique? We are backed by a preeminent fintech investor (Ribbit) and the world’s largest retailer (Walmart), maintain the speed and independence of a startup, and employ a strong (and growing) collection of world-class talent.

There’s never been a better moment to build a business that helps people achieve financial progress. Come build with us!

The role

As a Security Operations Engineer, your mandate is to find and remediate weaknesses in ONE’s security posture. This role will determine the current threat landscape and its applicability to ONE’s environment, and ensure swift responses to security events. This role will impact ONE’s vision by ensuring the safety of customer data and finances through regularly working with a variety of people in security, product, third parties, and other business functions to rapidly identify and mitigate security issues. Success in this role looks like ensuring the success of ONE’s vulnerability management program, identifying and mitigating security issues through both industry-standard and innovative techniques, and maturing ONE’s red and purple team activities.

This role is responsible for:

• Collaborating with cross-functional teams to identify, assess, and prioritize vulnerabilities within the organization's systems and infrastructure.

• Performing vulnerability discovery using both industry-standard and custom-built tools and techniques, triaging results and prioritizing remediation efforts.

• Tuning vulnerability discovery tooling to optimize for ONE’s environment and specific threat models.

• Coordinating and overseeing the patch management process, including the deployment of security patches and updates to mitigate known vulnerabilities in a timely manner.

• Conducting application and infrastructure penetration testing, vulnerability assessments, and security evaluations of inter-system integrations and application deployments to proactively identify weaknesses and gaps in the organization's security posture.

• Performing threat hunting activities and maturing ONE’s red and purple team activities.

• Mature ONE’s threat intelligence program to rapidly evolve controls in response to the current threat landscape.

• Maintaining accurate records of vulnerabilities, remediation activities, and risk assessments. Prepare and present comprehensive reports to stakeholders highlighting key findings, trends, and recommendations.

• Staying abreast of emerging threats, vulnerabilities, and security technologies. Recommend and implement process improvements and security controls to enhance the organization's security posture.

• Participating in a 24x7 security incident response on-call rotation.

You bring

• 5+ years working experience in Information Security, preferably with a focus on vulnerability management and security assessments, with experience in proactive security engineering.

• Business acumen and ability to effectively communicate business risk from cybersecurity issues to audiences with varying levels of technical background.

• Experience with at least one major cloud service provider: AWS, GCP, Azure

• Strong knowledge of: cloud computing, defense-in-depth strategies, secure design patterns for applications and platforms.

• Deep understanding of security threat modeling, risk prioritization, and operational and technical security measures (including using industry frameworks, such as MITRE ATT&CK)

• Preferably, proficiency for automation and tool development purposes in TypeScript.

• Excellent analytical and problem-solving skills, with the ability to prioritize and manage multiple tasks in a fast-paced environment.

We use Covey as part of our hiring process for jobs in NYC and certain features may qualify it as an AEDT. As part of the evaluation process we provide Covey with job requirements and candidate submitted applications. We began using Covey Scout for Inbound on May 31, 2024.

Please see the independent bias audit report covering our use of Covey here.

Leveling Philosophy

In order to thoughtfully scale the company and avoid downstream inequities, we’ve adopted a flat titling structure at One. Though we may occasionally post a role externally with a prefix such as “Senior” to reflect the external level of the position, we do not use prefixes in titles like that internally unless in a position which manages a team. Internal titles typically include your specific functional responsibility, such as engineering, product management or sales, and often include additional descriptors to ensure clarity of role and placement within our organization (i.e. “Engineer, Platform”, “Sales, Business Development” or “Manager, Talent”). Employees are paid commensurate with their experience and the internal level within One.

Inclusion & Belonging

To build technology and products that are used and loved by people and solve real-world problems, we need to build a team with many different perspectives and experiences. We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status. We encourage candidates from all backgrounds to apply. Applicants in need of special assistance or accommodation during the interview process or in accessing our website may contact us at talent@one.app.