About One

One’s mission is simple - to help customers achieve financial progress. We’re doing this by creating simple solutions to help our customers save, spend, borrow, and grow their money – all in one place.

The U.S. consumer today deserves better. Millions of Americans today can’t access credit, build savings or wealth, and are left to manage their financial lives through multiple disconnected apps. Almost a quarter of U.S. adults are unbanked or underbanked and roughly 80% of fintech users rely on multiple accounts to manage their finances.

What makes us unique? We are backed by a preeminent fintech investor (Ribbit) and the world’s largest retailer (Walmart), maintain the speed and independence of a startup, and employ a strong (and growing) collection of world-class talent.

There’s never been a better moment to build a business that helps people achieve financial progress. Come build with us!

The role

As a Product Security Engineer, you'll be responsible for ensuring that One delivers secure and reliable applications at scale. By partnering with engineers to build security into the product from the ground up, you’ll be creating engineering tools and workflows that test and validate artifacts and actively developing security frameworks.   You’ll provide subject-matter expertise to product teams regarding security best practices, optimize our secure coding practices, and use offensive security techniques to harden our environment and help improve our overall security posture. Come be the champion of modern Product Security Engineering at One and have a direct impact on the security of all of our products!

This role is responsible for:

• Architecting and implementing secure AWS configurations, including IAM policies, encryption, and network segmentation.

• Securing CI/CD pipelines and code repositories, integrating policy-as-code tools to enforce security standards.

• Enhancing container and orchestration security (Docker, Kubernetes, EKS) to ensure safe and reliable production environments.

• Conducting threat modeling exercises to identify and addressing risks in early stages of development.

• Performing secure code reviews, leveraging SAST/SCA tools, and guiding remediation with development teams.

• Automating routine security tasks using scripting languages, improving efficiency and accuracy.

• Developing, maintaining, and extending our in-house application security and penetration testing automated testing framework.

• Working with the Security and other engineering teams to maintain a security architecture that provides security controls throughout all platforms to mitigate risk, and to meet goals and regulatory requirements.

You bring

• 10+ years of experience in security engineering, DevSecOps, and application development.

• Excellent knowledge of the CVSS, MITRE ATT&CK, and OWASP Top 10.

• Practical understanding of AWS and its core services (VPC, EC2, RDS).

• Hands-on experience securing IaC and CI/CD pipelines, including code scanning and policy enforcement tools.

• Strong knowledge of container security best practices and orchestration platforms.

• Practical experience in application security, including threat modeling, secure code review, and penetration testing.

• Familiarity with detection engineer, SIEM tuning, and scripting automation.

• Demonstrated experience in modern application architecture and deployment practices.

• Expertise in verifying and measuring common security vulnerabilities, and demonstrated ability to communicate these concepts to technical and non-technical partners.

• Experience defining security architecture patterns and standards.

• Preferably, understanding of regulatory compliance concerns (GLBA, CCPA, PCI).

• The Triple H Factor: Humble, Hungry and Honest.

Pay Transparency

The estimated annual base salary for this position ranges from $175,000 to $220,000. Pay is generally based upon the level, complexity, responsibility, and job duties / requirements of the specific position. We then source candidates with the requisite skills, expertise, education, training, and experience.  If you are selected for an interview, please feel welcome to speak to a Talent Partner about our compensation philosophy and other available benefits.

What it’s like working @ One

• Competitive cash

• Benefits effective on day one

• Early access to a high potential, high growth fintech

• Generous stock option packages in an early-stage startup

• Remote friendly (anywhere in the US) and office friendly - you pick the schedule

• Flexible time off programs - vacation, sick, paid parental leave, and paid caregiver leave

• 401(k) plan with match

Leveling Philosophy

In order to thoughtfully scale the company and avoid downstream inequities, we’ve adopted a flat titling structure at One. Though we may occasionally post a role externally with a prefix such as “Senior” to reflect the external level of the position, we do not use prefixes in titles like that internally unless in a position which manages a team. Internal titles typically include your specific functional responsibility, such as engineering, product management or sales, and often include additional descriptors to ensure clarity of role and placement within our organization (i.e. “Engineer, Platform”, “Sales, Business Development” or “Manager, Talent”). Employees are paid commensurate with their experience and the internal level within One.

Inclusion & Belonging

To build technology and products that are used and loved by people and solve real-world problems, we need to build a team with many different perspectives and experiences. We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status. We encourage candidates from all backgrounds to apply. Applicants in need of special assistance or accommodation during the interview process or in accessing our website may contact us at talent@one.app.