Senior Security Engineer, Threat & Offensive Security
for each section heading. Use - for lists. Use
for prose. Do not repeat job title. Do not include Job ID etc. Remove boilerplate like EEO, equal opportunity, scam warning, application instructions, etc. Also remove duplicated lines. Preserve all substantive info.
We need to decide which sections to include based on content.
We have:
- About The Company: paragraph(s). Should be included as
About the Company
then ...
.
- About The Role: paragraph(s). Include About the Role
then ...
.
- Responsibilities: list of bullet points. Include Responsibilities
then - ...
.
- Ideal Background: list of bullet points (skills). Could be a section like Ideal Background
or maybe Requirements
. The instruction says use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we can map Ideal Background to Requirements or Qualifications. Probably "Requirements". We'll use Requirements
then - ...
.
- Minimum Qualifications: list of bullet points. Could be Minimum Qualifications
or "Qualifications". Use Qualifications
.
- Benefits: list of bullet points. Use Benefits
.
- Pay: we have Base Compensation Band: $180K - 230K. Also mention Compensation: Competitive salary with equity, 401k. Also Compensation Range repeated. We should include Pay section only if posting states them. It does. So Pay
then Base Compensation Band: $180K - $230K. Base salary offered is determined by a number of factors including the candidate’s experience, qualifications, and skills. This Base Compensation pay range applies to our New York City located staff and may differ according to location. Compensation: Competitive salary with a meaningful stake in the company via equity, and 401k plan.
Possibly also mention "Compensation Range: $180K - $230K" but that's duplicate; we can keep once.
- Schedule: not mentioned, so omit.
We need to remove boilerplate: "Throughout the interview process, please remember that emails will only be from valon.com email addresses..." etc. Also "Valon is an equal opportunity employer..." etc. Also "Valon offices are located in New York City and San Francisco, but we fully support remote work!" That's part of About The Company? It's in the company description; we can keep it as part of About the Company paragraph. It's not boilerplate; it's substantive.
We need to ensure we don't include duplicated lines: The compensation appears twice; we can include once.
We need to ensure we don't include placeholder text like "commensurate with experience" etc. Not present.
Now craft HTML.
Structure:
About the Company
Valon is building the AI-native operating system for regulated finance, starting with mortgage servicing. We're a Series C company backed by a16z, transforming industries that others have written off as too complex to innovate. Rather than build on top of broken legacy systems, we took a different approach: we built and operate our own mortgage servicing business managing $110+ billion in loans. This wasn't the end goal, it was how we deeply understood the complexity needed to build software that actually works in regulated industries. The results speak for themselves. We've transformed mortgage servicing from a 0% margin business into 60%+ margins while dramatically improving customer experience. Major enterprise contracts are now deploying across the industry. ValonOS is our unified platform that makes every process structured and programmable and it is perfectly positioned for the AI era. When everything flows through one system with rich data, AI agents don't just automate tasks, they continuously improve entire operations. Mortgage servicing is just the beginning of our vision to transform regulated industries and beyond. Security at Valon Our customers entrust us with some of their most sensitive and personal financial information, and it is the ultimate mission of Valon’s Security team to ensure we have sound programs, processes, and automation in place to safeguard our customers’ data. The Security team protects the infrastructure and data for processing billions of dollars of mortgage loans. In addition to protecting Valon’s internal systems, the Security team partners closely with Product and Engineering to design and deliver secure, scalable, and trustworthy capabilities for ValonOS. We work cross-functionally across all teams at Valon to enable security throughout the organization. We engage with external security auditors, pentesting firms, and partners to continuously evaluate Valon’s security posture. Valon offices are located in New York City and San Francisco, but we fully support remote work!
About the Role
We are seeking an experienced and skilled Senior Security Engineer, Threat & Offensive Security to join our growing team! As a key security member at Valon, you will help scale and strengthen our offensive security and threat operations, proactively identifying weaknesses in our systems, networks, and applications as the company continues to grow. This position requires a deep understanding of adversarial techniques, security testing methodologies, threat intelligence, and incident response, along with the ability to collaborate with cross-functional teams. Importantly, this role requires an AI and automation-first approach to security work, using modern tools to scale testing, threat management, and response. You will help ensure security is embedded across our environment and that we continue to safeguard our most critical assets and maintain the trust of our customers and stakeholders.
Responsibilities
- Drive and conduct security testing and penetration tests across applications, infrastructure, and networks to identify exploitable vulnerabilities
- Manage and implement security testing tools and frameworks to simulate real-world attacks and validate the effectiveness of existing security controls
- Design and implement AI-enabled workflows to scale security testing and threat related operations.
- Manage and operationalize threat intelligence to anticipate emerging threats and adjust defenses proactively
- Partner with external pentesting firms for periodic, independent reviews
- Perform security reviews of new systems, features, architectures, and third-party integrations, providing actionable risk-based recommendations
- Collaborate with Engineering, IT, Product and other teams to remediate identified vulnerabilities and strengthen security controls
- Develop and refine playbooks, procedures, and standards for offensive security testing, threat monitoring, and incident response
- Monitor and manage security alerts and incidents, analyze data, and respond to security events
- Support operational activities including general security reviews, security monitoring, vendor security, issue remediation, security awareness, audit/compliance, and other processes
Requirements
- Proven experience in security engineering, red team, or threat management role, with a focus on penetration testing, security testing, threat intelligence, and/or incident response
- Hands-on experience with security testing tools and frameworks (e.g., Burp Suite, Metasploit, Nmap, Cobalt Strike, or similar)
- Demonstrated experience leveraging AI and automation to improve the efficiency and scalability of threat detection, testing, and response operations
- Proficient in both manual and automated testing techniques, understanding when manual analysis is needed versus pure automated testing
- Strong understanding of common attack techniques, exploitation methods, and MITRE ATT&CK or related
- Experience with SIEM, EDR, and other detection/monitoring platforms
- Experience with cloud security and environments (GCP, AWS)
- Ability to work autonomously, lead projects, and navigate complex, ambiguous security investigations
- Ability to foster strong relationships and partner with stakeholders to drive remediation and results
- Excellent communication and collaboration skills, with the ability to explain technical findings and risk to both technical and non-technical stakeholders
- Applied knowledge of industry security and testing frameworks (OWASP, NIST, MITRE ATT&CK, CIS, SOC 2/ISO 27001 concepts)
- Experience or exposure to startup environments is a plus
Qualifications
- Minimum of 5 years in a security engineering, penetration testing, threat intelligence, or similar roles with relevant responsibilities and background
- Bachelor's degree in Computer Science, Information Security, Technology, or a related field
- Relevant security certifications (e.g., CISSP, CEH, OSCP, GPEN, GCIH or similar)
- Knowledge of cloud environments
- Experience with security testing, monitoring, and response technologies (threat intelligence platforms, vulnerability scanners, SIEM, EDR, or similar)
Benefits
- Base Compensation Band: $180K - 230K. Base salary offered is determined by a number of factors including the candidate’s experience, qualifications, and skills. This Base Compensation pay range applies to our New York City located staff and may differ according to location.
- Compensation: Competitive salary with a meaningful stake in the company via equity, and 401k plan
- Health & well-being: We’ll invest in your physical and mental well-being with comprehensive medical, dental, & vision benefits
- Commuter benefits: We offer pre-tax deductions for public transportation, rideshare services, and parking expenses to make your commute more affordable and convenient
- Grow together: Company wide orientation for you to successfully onboard and other learning & development opportunities including regular review cycles that feature 360 degree feedback
- Play together: Quarterly budgets for team and company outings. Use it for team swag, cooking classes, or team dinners!
- Generous time off: Flexible paid time off, sick days, and 11 company holidays
- Baby bonding time: 12 weeks off for both birthing and non-birthing parents - fully paid so you can focus your energy on your newest addition
We might have duplicated compensation in Benefits list; we could separate Pay section. But we already included compensation in Benefits list as first two items. Could also create a Pay section separate. However instruction: Prefer a few substantive sections over many thin ones. We could keep Benefits section with all benefits including compensation. That's fine.
But we also have a separate Pay section maybe redundant. Let's decide: The instruction says include Pay section only if posting actually states them. It does state Base Compensation Band and Compensation. We could either put them in Benefits or Pay. Since Benefits already includes compensation items, we could keep Benefits and not add Pay. However the instruction says "Prefer a few substantive sections over many thin ones." Having both Benefits and Pay may be thin. Better to combine compensation into Benefits. So we will not create a separate Pay section. We'll keep Benefits as above, which includes compensation items.
Thus final HTML includes sections: About the Company, About the Role, Responsibilities, Requirements, Qualifications, Benefits.
Check for any leftover boilerplate: We removed interview process email, equal opportunity, etc. Also removed "Throughout the interview process..." and "Valon is an equal opportunity employer..." and "Valon makes hiring decisions based solely on qualifications..." etc.
Check for duplicate lines: We have "Base Compensation Band: $180
for prose. Do not repeat job title. Do not include Job ID etc. Remove boilerplate like EEO, equal opportunity, scam warning, application instructions, etc. Also remove duplicated lines. Preserve all substantive info. We need to decide which sections to include based on content. We have: - About The Company: paragraph(s). Should be included as
About the Company
then...
. - About The Role: paragraph(s). IncludeAbout the Role
then...
. - Responsibilities: list of bullet points. IncludeResponsibilities
then- ...
Ideal Background
or maybeRequirements
. The instruction says use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we can map Ideal Background to Requirements or Qualifications. Probably "Requirements". We'll useRequirements
then- ...
Minimum Qualifications
or "Qualifications". UseQualifications
. - Benefits: list of bullet points. UseBenefits
. - Pay: we have Base Compensation Band: $180K - 230K. Also mention Compensation: Competitive salary with equity, 401k. Also Compensation Range repeated. We should include Pay section only if posting states them. It does. SoPay
thenBase Compensation Band: $180K - $230K. Base salary offered is determined by a number of factors including the candidate’s experience, qualifications, and skills. This Base Compensation pay range applies to our New York City located staff and may differ according to location. Compensation: Competitive salary with a meaningful stake in the company via equity, and 401k plan.
Possibly also mention "Compensation Range: $180K - $230K" but that's duplicate; we can keep once. - Schedule: not mentioned, so omit. We need to remove boilerplate: "Throughout the interview process, please remember that emails will only be from valon.com email addresses..." etc. Also "Valon is an equal opportunity employer..." etc. Also "Valon offices are located in New York City and San Francisco, but we fully support remote work!" That's part of About The Company? It's in the company description; we can keep it as part of About the Company paragraph. It's not boilerplate; it's substantive. We need to ensure we don't include duplicated lines: The compensation appears twice; we can include once. We need to ensure we don't include placeholder text like "commensurate with experience" etc. Not present. Now craft HTML. Structure:About the Company
Valon is building the AI-native operating system for regulated finance, starting with mortgage servicing. We're a Series C company backed by a16z, transforming industries that others have written off as too complex to innovate. Rather than build on top of broken legacy systems, we took a different approach: we built and operate our own mortgage servicing business managing $110+ billion in loans. This wasn't the end goal, it was how we deeply understood the complexity needed to build software that actually works in regulated industries. The results speak for themselves. We've transformed mortgage servicing from a 0% margin business into 60%+ margins while dramatically improving customer experience. Major enterprise contracts are now deploying across the industry. ValonOS is our unified platform that makes every process structured and programmable and it is perfectly positioned for the AI era. When everything flows through one system with rich data, AI agents don't just automate tasks, they continuously improve entire operations. Mortgage servicing is just the beginning of our vision to transform regulated industries and beyond. Security at Valon Our customers entrust us with some of their most sensitive and personal financial information, and it is the ultimate mission of Valon’s Security team to ensure we have sound programs, processes, and automation in place to safeguard our customers’ data. The Security team protects the infrastructure and data for processing billions of dollars of mortgage loans. In addition to protecting Valon’s internal systems, the Security team partners closely with Product and Engineering to design and deliver secure, scalable, and trustworthy capabilities for ValonOS. We work cross-functionally across all teams at Valon to enable security throughout the organization. We engage with external security auditors, pentesting firms, and partners to continuously evaluate Valon’s security posture. Valon offices are located in New York City and San Francisco, but we fully support remote work!
About the Role
We are seeking an experienced and skilled Senior Security Engineer, Threat & Offensive Security to join our growing team! As a key security member at Valon, you will help scale and strengthen our offensive security and threat operations, proactively identifying weaknesses in our systems, networks, and applications as the company continues to grow. This position requires a deep understanding of adversarial techniques, security testing methodologies, threat intelligence, and incident response, along with the ability to collaborate with cross-functional teams. Importantly, this role requires an AI and automation-first approach to security work, using modern tools to scale testing, threat management, and response. You will help ensure security is embedded across our environment and that we continue to safeguard our most critical assets and maintain the trust of our customers and stakeholders.
Responsibilities
- Drive and conduct security testing and penetration tests across applications, infrastructure, and networks to identify exploitable vulnerabilities
- Manage and implement security testing tools and frameworks to simulate real-world attacks and validate the effectiveness of existing security controls
- Design and implement AI-enabled workflows to scale security testing and threat related operations.
- Manage and operationalize threat intelligence to anticipate emerging threats and adjust defenses proactively
- Partner with external pentesting firms for periodic, independent reviews
- Perform security reviews of new systems, features, architectures, and third-party integrations, providing actionable risk-based recommendations
- Collaborate with Engineering, IT, Product and other teams to remediate identified vulnerabilities and strengthen security controls
- Develop and refine playbooks, procedures, and standards for offensive security testing, threat monitoring, and incident response
- Monitor and manage security alerts and incidents, analyze data, and respond to security events
- Support operational activities including general security reviews, security monitoring, vendor security, issue remediation, security awareness, audit/compliance, and other processes
Requirements
- Proven experience in security engineering, red team, or threat management role, with a focus on penetration testing, security testing, threat intelligence, and/or incident response
- Hands-on experience with security testing tools and frameworks (e.g., Burp Suite, Metasploit, Nmap, Cobalt Strike, or similar)
- Demonstrated experience leveraging AI and automation to improve the efficiency and scalability of threat detection, testing, and response operations
- Proficient in both manual and automated testing techniques, understanding when manual analysis is needed versus pure automated testing
- Strong understanding of common attack techniques, exploitation methods, and MITRE ATT&CK or related
- Experience with SIEM, EDR, and other detection/monitoring platforms
- Experience with cloud security and environments (GCP, AWS)
- Ability to work autonomously, lead projects, and navigate complex, ambiguous security investigations
- Ability to foster strong relationships and partner with stakeholders to drive remediation and results
- Excellent communication and collaboration skills, with the ability to explain technical findings and risk to both technical and non-technical stakeholders
- Applied knowledge of industry security and testing frameworks (OWASP, NIST, MITRE ATT&CK, CIS, SOC 2/ISO 27001 concepts)
- Experience or exposure to startup environments is a plus
Qualifications
- Minimum of 5 years in a security engineering, penetration testing, threat intelligence, or similar roles with relevant responsibilities and background
- Bachelor's degree in Computer Science, Information Security, Technology, or a related field
- Relevant security certifications (e.g., CISSP, CEH, OSCP, GPEN, GCIH or similar)
- Knowledge of cloud environments
- Experience with security testing, monitoring, and response technologies (threat intelligence platforms, vulnerability scanners, SIEM, EDR, or similar)
Benefits
- Base Compensation Band: $180K - 230K. Base salary offered is determined by a number of factors including the candidate’s experience, qualifications, and skills. This Base Compensation pay range applies to our New York City located staff and may differ according to location.
- Compensation: Competitive salary with a meaningful stake in the company via equity, and 401k plan
- Health & well-being: We’ll invest in your physical and mental well-being with comprehensive medical, dental, & vision benefits
- Commuter benefits: We offer pre-tax deductions for public transportation, rideshare services, and parking expenses to make your commute more affordable and convenient
- Grow together: Company wide orientation for you to successfully onboard and other learning & development opportunities including regular review cycles that feature 360 degree feedback
- Play together: Quarterly budgets for team and company outings. Use it for team swag, cooking classes, or team dinners!
- Generous time off: Flexible paid time off, sick days, and 11 company holidays
- Baby bonding time: 12 weeks off for both birthing and non-birthing parents - fully paid so you can focus your energy on your newest addition