Application Security Engineer

Location: Toronto, Canada (downtown Toronto office, in-person four days per week — Mon, Tue, Thu, Fri)

Our Security Engineering team builds intelligent systems that protect Opendoor and our customers while enabling unprecedented engineering velocity. We apply software engineering and AI to solve security problems across product, infrastructure, and operations by building guardrails where they matter, not gates where they don't.

As our Application Security Engineer, you'll own how we find, prioritize, and drive down application-layer risk across the consumer flows that put cash offers in homeowners' hands, the GraphQL APIs that power our products, and the AI agents and vibe-coded tools our engineers ship every week. The job is to make it safe to build fast, not to slow things down.

What You'll Do

• Define, build and operate Opendoor's application vulnerability identification capability — the tooling, triage workflow and remediation techniques across our consumer products, internal admin tools and GraphQL API powering home acquisition, resale, mortgage, title and escrow.
• Assess, rationalize and own our AppSec tooling stack — static and dynamic security testing, software supply chain risk detection and secrets scanning — and integrate findings into developer workflows (GitHub, Linear, Slack).
• Own and mature our HackerOne program: tightening triage workflow, improving signal to noise, strengthening researcher relationships, closing the loop with engineering teams.
• Lead threat modeling and security design reviews for new services, APIs, and mobile features. Turn the patterns you see into rules, lint checks, and CI guardrails.
• Build AI agents and automated workflows that triage vulnerability reports, validate exploit reproductions, and draft remediation pull requests, replacing manual security review with high-signal automation.
• Partner with engineering teams to harden authentication, authorization, and input validation across our codebase and production services, including the GraphQL gateway (Apollo) and our Kubernetes workloads.
• Build Opendoor's offensive security capability. Scope and run internal security testing, red team exercises and adversarial analysis of our highest-risk flows.
• Set the bar for what "secure by default" looks like for AI-maximalist engineering, including vibe-coded apps, MCP servers, and agent-driven workflows that touch production data.

Tech Stack

• Languages: Go, Python, TypeScript, Ruby, Terraform
• Cloud: AWS, GCP, Azure, Kubernetes, Apollo GraphQL
• AppSec Tooling: GitHub Advanced Security (CodeQL, Dependabot, secret scanning), Semgrep, HackerOne, Burp Suite, Cloudflare WAF
• AI Tooling: Claude, OpenAI, various agent frameworks, MCP — used heavily for vulnerability triage, exploit verification, and remediation drafting

What You'll Need

• Deep conviction that AI and automation should eliminate manual work and increase the team's impact, and a track record to prove it. You've built agentic systems that replaced reactive security work, not just configured off-the-shelf tools.
• Comfort operating with high autonomy in ambiguous environments.
• Business enablement security mindset. You measure success by business impact and informed risk-taking, not by tickets opened or pen test reports filed.
• Application security or software engineering experience with a security focus, with strong skills in at least one of Python, Go, TypeScript, or Ruby.
• Hands-on expertise across the security risk detection toolchain with real deployment experience using GitHub Advanced Security, Semgrep, or equivalent.
• Strong grasp of common application and API vulnerability classes including GraphQL, REST, and gRPC security pitfalls.
• Practical threat modeling skills.
• Experience with cloud and container security on AWS and Kubernetes.

Bonus Points

• Offensive security experience including pentesting, API security, or mobile security, and/or red team operations.
• Experience running a bug bounty or coordinated disclosure program at scale.
• Mobile application security review experience (iOS and Android).
• Experience securing AI and machine learning pipelines, agent frameworks, or MCP-style integrations.
• OSCP, OSWE, or similar offensive certifications.