Top of page

Job intelligence

Senior Security Analyst

OpenSesame

Location: Remote — Worldwide Advertised pay: USD 130,000–190,000 / yearly Work arrangement: Worldwide remote Employment: Full Time Posted: November 7, 2026 Freshness: Posted today Source check: Observed today
Disclosure5 of 5 core facts statedReview uncertainties
Last source observationObserved todayObservation is not employer confirmation.
Application destinationhimalayas.appReview the application route and source evidence in the full report below.

Executive opportunity brief

The decision in one screen

A compact evidence-first read of compensation, flexibility, mobility and what still needs verification. No universal quality score is used.

Compensation positionBelow the current median29 current same-currency observations
Work flexibilityWorldwide remoteBased only on stated location/work-arrangement evidence.
Decision evidence5 of 5 core facts knownThis listing states more core decision facts than the median role in the current sample.
Mobility evidenceSponsorship not establishedUnknown evidence is not treated as unavailable.
Current alternatives376 current same-family rolesCurrent HPJ inventory, not the whole labor market.
Negotiation readinessNegotiation evidence available: advertised pay range, current same-currency market context, strong decision evidence.Use the private Offer & Negotiation Lab below if an offer arrives.

Fast read

Opportunity DNA

One strong reason to look closer: location flexibility looks unusually broad. An important detail is still open: confirm whether a degree is actually required, preferred, or replaceable with equivalent experience.

May appeal in aRemote-first search
PayRange available

Current comparable position is around the 45th percentile.

FlexibilityBroad location freedom

No material geography, office-attendance or timezone restriction is visible in the available wording.

Entry pathRequirements unclear

The listing does not make the minimum education or experience threshold clear enough yet.

MobilityNot established

Sponsorship and relocation support are not clear from the current listing.

ApplicationSome process detail

Part of the application route can be assessed, but the full external process may contain additional steps.

TraceabilityCurrent source traceable

At least one recent enabled source can still renew this vacancy.

This fingerprint summarizes what is clear, constrained or still unanswered in the current listing. It is a reading aid, not an overall job score.

Decision evidence check

5 of 5 core facts stated

This checks whether the listing states the facts that commonly change an employment decision. It measures disclosure completeness, not whether the opportunity is good or bad.

Facts already stated

  • Compensation
  • Work arrangement
  • Advertised location
  • Application closing time
  • Employment type

Core evidence complete

All five core facts are stated. Other details can still matter, so continue with the qualification, mobility, employer and application checks below.

Advertised location is not proof of work authorization, sponsorship, or legal eligibility. Unknown information is not a negative score; verify those questions separately.

Decision levers

What could make or break the fit?

Reasons to look closer

  • Location flexibility looks unusually broad: The available wording supports high Remote Freedom without a material geography, office-attendance or timezone restriction showing up.

Trade-offs to weigh

No major trade-off is stated clearly in the information available here. Employment terms outside the listing may still matter.

Questions worth asking before you invest more time

  • Confirm whether a degree is actually required, preferred, or replaceable with equivalent experience.
  • Confirm the actual minimum experience requirement rather than assuming preferred background is mandatory.
  • Ask whether visa sponsorship is available before investing significant time in the application.

These questions come from details the listing leaves open. An unanswered point is not treated as a disadvantage.

Opportunity neighborhood

Keep your options open

These live roles sit close enough to this opportunity to make useful comparison points. Look across several employers before deciding what pay, flexibility or access trade-offs you are willing to accept.

Staff Information Security Engineer

Rithum · USA

USD 170,000–220,000 / year Region-restricted remote 4/5 core facts

Why it is nearby: Same seniority band · Similar work arrangement · Same employment type

About 22% higher advertised midpoint

Sr. Application Security Engineer

hims & hers · USA

USD 135,000–165,000 / year Region-restricted remote 4/5 core facts

Why it is nearby: Same seniority band · Similar work arrangement · Same employment type

About 6% lower advertised midpoint

Senior Web Application Security Engineer

EPAM Systems · Anywhere in the World, 🇺🇸 United States of America, 🇦🇲 Armenia, 🇬🇪 Georgia, and 🇧🇾 Belarus

Salary not disclosed Worldwide remote 4/5 core facts

Why it is nearby: Same seniority band · Similar work arrangement · Same employment type

(Senior) IT Security Engineer (m/w/d)

noris network AG · Berlin

Salary not disclosed Remote — restrictions unclear 2/5 core facts

Why it is nearby: Same seniority band · Similar work arrangement · Recently posted

This neighborhood is drawn from current inventory in the same broad occupation. Similarity is based on explicit listing facts; missing details do not count against a job.

Role market context

How much current choice is visible around this kind of work?

This compares the vacancy with current High Paid Job inventory in the broad Cybersecurity roles family. It describes visible choice and disclosure, not future demand or career quality.

Current visible roles376

200 most recent current roles sampled for the disclosure measures below.

Employers represented155

Distinct employers in the bounded current sample, not an estimate of all employers hiring in the market.

Decision-ready disclosure27%

Current sampled roles stating at least four of the five Core Decision Facts.

Compensation stated39%

Requires a numeric amount, explicit ISO currency and supported pay period.

Work arrangement stated79%

Listings with explicit enough remote, hybrid or on-site evidence to classify.

Stated closing time32%

Missing deadline evidence remains unknown and is not interpreted as an open-ended application window.

Disclosure comparison: This listing states more core decision facts than the median role in the current sample. This listing: 5/5 · sample median: 3.0/5.

Currencies with explicit pay evidence in the sample: USD (63) · EUR (7) · GBP (3) · ZAR (1). Raw amounts across different currencies are not compared.

This describes current visible High Paid Job inventory in the same broad occupation family. Percentages use a bounded recent sample and are not a forecast, a complete labor-market census or an employer-quality measure.

Constraint opportunity lab

What changes the size of the current opportunity pool?

Each line applies one stricter evidence-based constraint to the same bounded current role-family sample. It helps you see the trade-off in visible choice without deciding which trade-off is right for you.

Require explicit sponsorship or relocation support 0 / 200 0%

Counts only affirmative or possible sponsorship evidence, or relocation explicitly offered. Unknown is not treated as no.

Require worldwide remote evidence 19 / 200 10%

A much stricter subset: only listings with explicit worldwide-remote evidence remain.

Require at least four Core Decision Facts 54 / 200 27%

Shows the subset with enough stated evidence for a more informed first comparison.

Require a remote-listed arrangement 66 / 200 33%

Counts roles explicitly classified as worldwide remote, region-restricted remote or remote with restrictions still unclear.

Require usable compensation disclosure 77 / 200 39%

Requires amount, explicit ISO currency and a supported pay period. Missing pay evidence remains unknown.

Keep this advertised salary floor in the same currency 26 / 63 41%

Only same-currency opportunities with usable annualized pay enter this comparison. Other currencies are not converted or treated as lower.

Stay around the same seniority band 179 / 200 90%

Includes roles whose seniority is genuinely unspecified rather than assuming they belong to another level.

Keep the same employment type 111 / 114 97%

Uses only roles with a stated employment type.

These are counterfactual filters over a bounded sample of current HPJ inventory in the same broad occupation family. They show how visible choice changes when one evidence-based constraint is applied; they do not tell you which constraint you should choose or predict hiring outcomes. The calculation uses the 200 most recent current roles from 376 visible roles in this broad family.

Salary transparency context

Is pay disclosure typical for this kind of role?

This listing states usable structured compensation. About 39% of the bounded current role sample does the same.

This listingUsable pay stated

Compensation counts only when amount, ISO currency and supported pay period are all known.

Current same-role sample39%

Pay disclosure is limited in the current role sample.

Current employer patternInsufficient evidence

Employer-level comparison is withheld until enough current employer listings are available.

This compares salary-disclosure behavior in current visible listings. It does not compare raw salary amounts across currencies, infer undisclosed pay as zero, or rate employer quality.

Private offer & negotiation lab

Turn an offer into evidence, not guesswork

Enter an annual base offer and, if you want, your own target. HPJ compares only within one explicit currency and never chooses a target for you.

Advertised annualized payUSD 130,000–190,000 / yearListing evidence only.
Current comparable medianUSD 141,00061 current sampled roles
Current upper quartileUSD 165,503Current HPJ inventory context, not a salary recommendation.

Negotiation evidence available: advertised pay range, current same-currency market context, strong decision evidence.

Enter an annual base offer to compare it with explicit same-currency evidence. HPJ will not suggest a target for you.

Review the full package · 10 terms

Mark what is confirmed, what needs clarification and what you want to prioritize. These choices and notes stay in this browser.

Base payKnown

Usable advertised compensation is available.

Bonus / commissionVerify

Variable compensation is mentioned; verify amount, formula, target and eligibility.

Equity / long-term incentivesMentioned

Equity or long-term incentive language is mentioned; verify grant type, vesting and valuation basis.

Retirement / pensionMentioned

Retirement or pension benefits are mentioned; verify employer contribution and vesting.

Health benefitsMentioned

Health-benefit language is mentioned; verify coverage, dependants and employee cost.

Paid leaveMentioned

Paid-leave language is mentioned; verify the exact entitlement and carry-over rules.

Work arrangementKnown

A work-arrangement signal is available; verify schedule details before relying on it.

RelocationVerify

Relocation support not established

Visa / work authorizationVerify

Sponsorship not established

Review timingVerify

A review cycle is mentioned; verify timing and whether compensation can change at that review.

Questions worth taking into the offer conversation

  • Is there a bonus, commission or other variable-pay component, and how is it calculated?
  • If relocation is relevant, what expenses, timing and repayment conditions are covered?
  • What exact sponsorship or work-authorization conditions apply to this role?
  • When is the first performance and compensation review after joining?

Occupation intelligence

What broader career references connect to this role?

HPJ uses broad comparison families for current-market analysis. External taxonomy results are reference candidates for that broad family, not a declaration that this vacancy has been authoritatively classified into a specific occupation.

HPJ comparison familyCybersecurity roles
Adjacent families worth exploringSoftware engineering roles · Data & AI roles

European occupation references

This service uses the ESCO classification of the European Commission.

U.S. occupation references

This site incorporates information from O*NET Web Services by the U.S. Department of Labor, Employment and Training Administration (USDOL/ETA). O*NET® is a trademark of USDOL/ETA.

Career reference research

Skills worth investigating

Official occupational context, paired with exact phrases visible in this vacancy. It is not a skills test or an applicant-fit score.

ESCO · European occupation

cyber incident responder

Usually essential in this ESCO occupation
  • attack vectors
  • ICT security standards
  • GDPR
  • security engineering
  • security threats
  • cyber attack counter-measures
  • cyber security
Context-dependent ESCO skills
  • manage keys for data protection
  • consult with business clients
  • cloud technologies
  • ICT process quality models
  • troubleshoot

O*NET · U.S. occupation

Information Security Analysts

O*NET occupation skills
  • Reading Comprehension
  • Critical Thinking
  • Active Listening
  • Complex Problem Solving
  • Speaking
  • Writing
  • Judgment and Decision Making
  • Monitoring
Build my private skill preparation brief Your evidence · Practice · Interview questions

Plan how you might demonstrate or investigate occupational skills. These are broad-family reference examples, not confirmed vacancy requirements. Nothing you enter is sent to High Paid Job.

attack vectorsESCO · Essential · Listing mention unknown
ICT security standardsESCO · Essential · Listing mention unknown
GDPRESCO · Essential · Listing mention unknown
security engineeringESCO · Essential · Listing mention unknown
security threatsESCO · Essential · Listing mention unknown
cyber attack counter-measuresESCO · Essential · Listing mention unknown
cyber securityESCO · Essential · Listing mention unknown
manage keys for data protectionESCO · Optional · Listing mention unknown
consult with business clientsESCO · Optional · Listing mention unknown
cloud technologiesESCO · Optional · Listing mention unknown
ICT process quality modelsESCO · Optional · Listing mention unknown
troubleshootESCO · Optional · Listing mention unknown
Reading ComprehensionO*NET · Skills · Listing mention unknown
Critical ThinkingO*NET · Skills · Listing mention unknown
Active ListeningO*NET · Skills · Listing mention unknown
Complex Problem SolvingO*NET · Skills · Listing mention unknown
SpeakingO*NET · Skills · Listing mention unknown
WritingO*NET · Skills · Listing mention unknown
Judgment and Decision MakingO*NET · Skills · Listing mention unknown
MonitoringO*NET · Skills · Listing mention unknown

Private to this browser. Up to 20 reference skills; not a qualification assessment or hiring prediction.

Useful next question: Which of these occupational reference skills does the hiring manager actually expect for this specific role, and what evidence would demonstrate them?

These skills belong to one reference occupation selected for HPJ’s broad career family, not a verified classification of this vacancy. Text overlap only means a phrase appears in the available listing text; it does not establish an employer requirement, your proficiency, or a qualification gap. A missing mention is unknown, not a deficit.

Adjacent current roles to investigate

Data & AI roles

Lead Data Engineer

Oddball · USA

same seniority band · same employment type · similar work-arrangement evidence
Software engineering roles

Platform Engineer (Virtual, US)

Avaya · Remote — Worldwide

same seniority band · same employment type · similar work-arrangement evidence

Adjacent-family roles are exploration prompts from current HPJ inventory. They are not inferred qualification matches and they do not imply a promotion path.

Career move map

What sits one step away?

This listing is currently read as Senior / lead. Nearby roles one visible seniority step away can help you judge whether to widen the search, stretch upward or compare the responsibilities more carefully.

Broader-entry direction

Stretch direction

Leadership

Security Architect

NetBox Labs · USA

Similar work arrangement · Same employment type · Recently posted Advertised midpoint is about 38% higher

These are live roles one visible seniority step away in the same broad occupation family. They can reveal nearby options, but they are not a guaranteed promotion path and do not account for your personal experience.

Skill bridge

What does this role connect to?

AWS is one of the signals this listing shares with skills appearing often across current Cybersecurity roles opportunities.

Skills named in this listing

AWSGoogle CloudLarge Language ModelsPython

Shared with the current career sample

  • AWS Seen in 48 sampled listings
  • Google Cloud Seen in 29 sampled listings
  • Large Language Models Seen in 25 sampled listings
  • Python Seen in 47 sampled listings

Combinations also appearing together

  • AWS + Python appeared together in 29 sampled listings
  • AWS + Google Cloud appeared together in 27 sampled listings
  • Google Cloud + Python appeared together in 16 sampled listings

Application edge

  • If these skills match your background, prepare one concrete example that shows how you used AWS, Google Cloud, and Large Language Models rather than relying on a keyword-only claim.

If the named skills are genuinely transferable in your own experience, the occupation map also points to adjacent current families worth researching: Software engineering roles and Data & AI roles. This is exploration context, not a qualification match.

Skill signals come from explicit text mentions. A mention is not automatically a requirement, and absence from the current top-skill list does not make a skill rare or unimportant. The current career comparison draws on 106 sampled listings; 101 contain a recognized skill signal.

Application Decision Lab

Turn the listing into a preparation plan

Separate what the listing actually states from what you still need to prepare or verify. Your selections and short notes stay in this browser and are never submitted to High Paid Job.

Listing mention

AWS

This skill or technology is explicitly mentioned in the available listing text. A mention is not automatically a mandatory requirement; prepare a concrete example only if it is relevant to your experience.

Listing mention

Google Cloud

This skill or technology is explicitly mentioned in the available listing text. A mention is not automatically a mandatory requirement; prepare a concrete example only if it is relevant to your experience.

Listing mention

Large Language Models

This skill or technology is explicitly mentioned in the available listing text. A mention is not automatically a mandatory requirement; prepare a concrete example only if it is relevant to your experience.

Listing mention

Python

This skill or technology is explicitly mentioned in the available listing text. A mention is not automatically a mandatory requirement; prepare a concrete example only if it is relevant to your experience.

Questions worth resolving before you rely on the opportunity

  • Work authorization / sponsorship: If sponsorship or work authorization matters to you, what exact immigration or employer-sponsorship conditions apply to this role?
  • Application process: What interview, assessment, portfolio, reference or screening stages are part of the hiring process?

Decision analysis

What the listing really tells you

Useful decision context

Senior Security Analyst at OpenSesame becomes easier to judge once compensation has enough depth for comparison, the location rules are clear enough to judge, and the application route gives a few useful clues are viewed together. Here is the current read from the information available.

Compensation has enough depth for comparison

Among 29 current comparable salaries in USD, the normalized annual midpoint is around the 45th percentile. This compares advertised pay in the same currency and does not include every element of total compensation.

The location rules are clear enough to judge

Location flexibility can be assessed here: Highly location-flexible, with a Remote Freedom reading of 96/100.

The application route gives a few useful clues

Provider-mediated application path. The external application may contain additional steps that are not visible from the listing itself.

Source continuity adds useful context

The opportunity currently has 1 renewable source path across 1 source classes. Multiple independent paths can strengthen continuity, but they are not a substitute for checking the application destination.

How this analysis is assembled

This read combines the structured details currently available for pay, flexibility, qualifications, mobility, application effort and source continuity. Missing facts are left open for you to verify.

Analysis evidence coverage

How much analysis can the current evidence support?

100%Strong analysis evidence coverage
100%
Current-sample pay position45 / 100

Uses the explainable High Pay Score within the job’s current occupation/seniority/currency comparison sample.

Remote Freedom evidence96 / 100

Measures observable location flexibility and explicit restrictions; it does not determine whether remote work is personally desirable.

Salary evidence qualityHigh confidence · Focused salary range

The configured source supplied structured salary fields, a usable currency and a focused comparison value.

Listing freshnessPosted today

The source posting date is today.

Source provenance evidenceEstablished source evidence

At least one enabled source recently observed the vacancy. The source chain is traceable, but this is not independent employer verification.

There is no universal opportunity score because pay, flexibility and access matter differently to different people. Compare Jobs lets you weight the evidence around your own priorities.

Decision checklist

What is supported, uncertain or worth checking?

This checklist separates supported strengths, visible cautions and missing evidence. It is not an overall recommendation or guarantee that the job is suitable for you.

Supported strengths

  • The available work-location evidence indicates strong location flexibility.

Visible cautions

No specific caution is supported by the currently available evidence. This does not prove that none exists.

Still unknown

  • Visa sponsorship is not established by the available listing data.

Qualifications & access

What qualifications are explicitly stated?

Entry-barrier evidence limited

EducationEducation requirement not established
Required experience evidenceExperience requirement not established
Explicit required barriers0
Explicit access signals0

Qualification signals come from explicit listing wording. Anything not mentioned remains unknown, so silence is never treated as proof that a degree, experience, licence or other requirement is unnecessary.

Pay vs. barriers

Pay and barrier context available

The current pay position can be viewed alongside the stated barriers, but the available detail does not support a stronger conclusion.

Current-sample pay position

Comparable disclosed-pay evidence places this job at about 45 / 100 within its current occupation/seniority sample.

Evidence gaps that could change this interpretation
  • Education requirement is not established.
  • Required prior-experience level is not established.

This section weighs pay context against clearly stated barriers without collapsing unlike requirements into one universal score. Degree, experience, licensing, clearance and location limits remain separate, and missing qualification details stay unknown.

Beyond the headline

Not enough evidence for a hidden-value finding

Potential hidden value appears only when several distinct non-pay advantages are actually supported. Missing requirements or benefits are never counted as positives.

Strong location flexibility

The observable Remote Freedom evidence is strong and contains few explicit restriction signals.

Still check: The current application path is provider-mediated rather than directly classified as an employer-authorized or official route.

Hidden Value is an experimental evidence summary, not an investment-style score or guarantee of employability. It only uses explicit current listing evidence and does not infer that an unmentioned qualification is unnecessary.

Explainable opportunity highlight

Why this opportunity stands out

These are supported signals from the current listing and comparison sample—not a guarantee that this is the best job for you.

Clear compensation evidence

The source provides structured salary information with a comparatively focused range, improving the usefulness of pay comparisons.

Strong remote flexibility

The observable work-location signals indicate unusually strong location flexibility.

Fresh opportunity

The source posting date is today.

Compensation intelligence

How competitive is this pay?

45/100

Within the current market range

45%
Comparison familyCybersecurity roles · Senior / lead
Comparable salaries29
Current-sample medianUSD 175,000
Middle 50% of sampleUSD 142,833–195,000
Position in sampleAt or above about 45%
Comparison geographySame occupation, currency and seniority
Pay positionBelow the current median

The annualized midpoint is below the current comparable median but remains within the sample’s lower-to-middle range.

Why this analysis?

  • This score reflects the current advertised-pay distribution for comparable active jobs in the same currency. It measures pay position, not overall job quality.
  • Salary confidence: High. The configured source supplied structured salary fields, a usable currency and a focused comparison value.
  • Range quality: Focused salary range.

Employer compensation communication

Pay transparency at OpenSesame

Not enough current listings

Only 1 current listing from this employer is indexed. At least three are required before employer-level pay transparency is summarized.

This pattern comes from the employer’s current visible vacancies. It describes hiring and pay transparency in those listings, not employee satisfaction or a permanent judgement of the employer.

Current employer intelligence

OpenSesame — current opportunity snapshot

Employer-level patterns not available yet

Only 1 current listing from this employer is visible. At least three are needed before an employer pattern is shown.

This snapshot describes the employer’s current visible vacancies—things such as pay disclosure and work arrangement. It is not an employee-satisfaction or hiring-quality rating, and different currencies stay separate.

Work-location intelligence

Remote Freedom

96/100

Highly location-flexible

96%

Why this score?

  • The source describes the role as open worldwide or globally.

Flexibility signals detected

  • Worldwide or global remote eligibility is explicitly indicated.

Remote Freedom measures observable location flexibility only. Unknown work-location information remains unscored. Timezone wording is penalized only when it appears restrictive; general collaboration across time zones is not treated as a restriction. A score does not guarantee legal work eligibility, payroll availability or visa sponsorship.

International applicant intelligence

Visa & relocation signals

Sponsorship status is shown only when the listing provides clear enough wording. Employer history or headquarters location is not used to guess an answer.

Visa sponsorshipSponsorship not established

The available listing details do not contain a clear enough sponsorship statement.

RelocationRelocation support not established

The available listing details do not contain a clear enough relocation statement.

Tradeoff check

What’s the catch?

No obvious trade-off appears in the available job details. That does not mean the role has no drawbacks, so the original listing and employment terms are still worth reading carefully.

Current alternatives

Better-paying alternatives

These current roles show a materially higher annualized salary midpoint in the same broad occupation and currency. Similar seniority, country, work arrangement, employment type and recency are preferred where possible; higher pay alone does not make an alternative a better fit.

About +63% midpoint

Staff Product Security Engineer

Reddit · USA

Region-restricted remote

Why comparable: Same seniority band · Similar work-location arrangement · Same employment type

About +94% midpoint

Security Engineer, Agent Security

OpenAI · USA

Region-restricted remote

Why comparable: Same seniority band · Similar work-location arrangement · Same employment type

About +27% midpoint

Staff Product Security Architect

GitLab · Canada, Israel, Poland, UK, USA

Region-restricted remote

Why comparable: Same seniority band · Similar work-location arrangement · Same employment type

Alternatives are drawn from the current inventory rather than presented as application recommendations. A pay difference needs to be meaningful—about 3% or more at the midpoint—and different currencies are not compared.

Application-path intelligence

What can we see about the application process?

Provider-mediated application path

The current application path comes through a publisher or aggregator. The destination may still lead to an employer-authorized hiring system, but that is not clear enough to assume.

Current destination: himalayas.app · HTTPS

No additional required application step is clear in the available listing text. This does not mean the external application is one-click or friction-free.

Application effort is estimated from visible listing and source details. Optional steps are kept separate from mandatory ones, and the external form may contain additional requirements that are not visible here.

Application safety context

Application safety check

Basic application-safety context available

The current application destination has a basic transport-safety signal such as HTTPS. This does not verify the employer, vacancy, recruiter or application process.

Evidence checked: Source provenance · Application destination · Listing wording

Observable transport-safety signals

  • The available application destination uses HTTPS.
Before you share money or sensitive information
  • Confirm the vacancy on the employer’s official careers site when practical, especially if a recruiter contacts you outside the listed application path.
  • Check that recruiter email domains and application destinations are consistent with the employer or an identifiable recruiting provider.
  • Do not pay application, processing, training or equipment fees merely to be considered for a job.
  • Do not send cryptocurrency, gift cards, online-banking credentials or PINs as part of an application.
  • Treat unusually fast offers or interviews conducted only through informal messaging channels as reasons to verify the employer independently.

This is a limited safety screen, not employer verification and not a fraud determination. Never send money, cryptocurrency, passwords or sensitive banking credentials merely because a listing appears on a job platform.

Original listing details

The section below comes from the listing source. The decision sections above use the job’s structured pay, location, qualification, mobility and application details to give you additional context.

About OpenSesame

OpenSesame is the trusted partner for Workforce Reinvention in the age of AI. OpenSesame delivers integrated software, curated and customizable content, and expert services – embedded into existing learning, HR, and work systems – to help organizations expand their human+AI potential and thrive through change.

Learn more:

About the Role

As a Senior Security Analyst on our Compliance team, you will play a key role in strengthening OpenSesame’s security posture in a fast-moving, high-growth environment. We’re looking for someone who brings deep technical security expertise, a proactive mindset, and the ability to turn complex risks into practical, scalable solutions.

This role spans vulnerability management, penetration testing, bug bounty operations, cloud and application security, and audit readiness. You’ll partner across Engineering, DevOps, IT, and Compliance to improve security processes, support compliance efforts, and help ensure security is built into how we work, especially as we continue evolving our approach to AI security. We’re looking for proven examples from your career that show you can do this job; that you’ve owned penetration testing programs, built vulnerability management systems, implemented security automation, and helped organizations adopt modern technologies (including AI) securely and responsibly.

You’ll be a strong fit if you’re detail-oriented, collaborative, and excited to build programs that reduce risk, improve visibility, and support safe innovation across the business.

Performance Objectives

Establish Security Ownership & Technical Depth (0–6 Months)

  • Develop a comprehensive view of OpenSesame’s external attack surface, vulnerabilities, and threat landscape — integrating signals from CrowdStrike, cloud environments (AWS, GCP), and application security tooling.
  • Own external penetration testing engagements end-to-end — including vendor selection, scope design, execution oversight, remediation validation, and executive reporting.
  • Build and operationalize a structured vulnerability management program — partnering with DevOps, Engineering, and IT to prioritize and remediate risk effectively.
  • Stand up scalable evidence collection and control mapping workflows in Drata — improving audit readiness and reducing manual effort.
  • Establish strong cross-functional relationships to embed security into engineering, infrastructure, and IT workflows from the outset.

Operationalize Continuous & AI-Aware Security (6–12 Months)

  • Design and implement a continuous penetration testing program that complements annual third-party testing — leveraging automation, threat modeling, and targeted validation.
  • Own and mature the bug bounty program — improving signal quality, triage processes, researcher engagement, and remediation workflows.
  • Lead implementation of AI security practices across internal systems and product development:
    • Apply OWASP Top 10 for LLMs / AI systems to identify and mitigate emerging risks
    • Support adoption and operationalization of ISO 42001 controls
    • Define secure usage patterns for internal AI tools and third-party AI integrations
  • Partner with Product Engineering to define and enforce secure AI and application baseline requirements — ensuring security is built into system design, not retrofitted.
  • Develop automations and tooling (Python, APIs, Make) to continuously collect threat intelligence, validate security baselines, and detect drift across AWS, GCP, GitHub, and SaaS platforms.
  • Improve Jira and Confluence workflows to create visibility, accountability, and measurable progress across security findings and remediation.
  • Provide deep technical support during audits — translating real-world implementations into clear, defensible narratives aligned with ISO 27001, ISO 27701, and ISO 42001.

Drive Security Maturity & Compliance Integration (12+ Months)

  • Serve as a senior technical partner to Compliance — supporting vendor reviews, customer security questionnaires, and control design with practical, implementation-level expertise.
  • Continuously improve Drata automation and evidence pipelines — moving toward near real-time compliance visibility.
  • Partner with Engineering and DevOps leadership to evolve secure development practices, CI/CD security controls, and cloud security baselines.
  • Establish and refine AI security governance models — balancing innovation with risk management across internal and customer-facing use cases.
  • Identify systemic risks, recurring vulnerability patterns, and process inefficiencies — driving durable, organization-wide improvements.
  • Contribute to long-term security strategy — aligning threat management, AI adoption, compliance requirements, and engineering velocity.

What Success Looks Like

  • Penetration testing (external and continuous) is predictable, effective, and drives measurable reductions in risk.
  • Vulnerabilities are prioritized intelligently and remediated within defined SLAs, with clear ownership across teams.
  • The bug bounty program consistently yields high-quality findings with efficient triage and response.
  • AI systems and tools are deployed with clear security guardrails aligned to OWASP AI Top 10 and ISO 42001.
  • Engineering teams proactively incorporate security — including AI security — into design and development workflows.
  • Audit readiness becomes continuous rather than event-driven, with strong evidence pipelines in Drata.
  • Security is viewed as a strategic enabler of safe innovation, not a bottleneck.

You might notice we don’t have the typical list of requirements and buzzwords here. That’s intentional.

We’re looking for proven examples from your career that show you can do this job — that you’ve owned penetration testing programs, built vulnerability management systems, implemented security automation, and helped organizations adopt modern technologies (including AI) securely and responsibly.

When you look back a year from now, you’ll know you’ve made OpenSesame more secure, more resilient, and better positioned to innovate with confidence.

Although it should go without saying (but it doesn’t), OpenSesame is an equal opportunity employer and we strive to create a welcoming, inclusive environment that celebrates diversity.

Location: This position can be based anywhere in the US. We operate as a remote-first company, and invest in mandatory all-company meetings several times a year in addition to required team travel as necessary.

Performance Driven: We're looking for self-starters with a track record of delivering excellent results, but we're highly selective about who we hire. We don't focus on typical job requirements, instead, we're interested in specific examples from your past experiences. All positions can be based anywhere in the US, and require up to 15 days of travel per year, with senior management and leadership teams requiring up to 35 days.

Compensation: The base salary for this position generally ranges between $130,000 and $190,000 depending on experience. At OpenSesame, we offer a comprehensive benefits package to employees upon hire, including professional development, ISOs, health insurance, 401(k) matching, and paid time off.

Benefits: Benefits include comprehensive medical, dental, and vision coverage, flexible PTO, 401(k) matching, incentive stock options, volunteer time off, Employee Resource Groups, and a generous professional development program with dedicated annual time off for learning and growth.

We use AI. For real. Every team at OpenSesame works with AI tools daily, not as a buzzword, but as practice. You'll build fluency that most companies are still talking about adopting, with hands-on training and clear guardrails to experiment responsibly. AI amplifies your creativity and judgment. It doesn't replace them. The skills you build here travel with you.

Equal Employment Opportunity: OpenSesame is an Equal Employment Opportunity and Affirmative Action employer that values and welcomes diversity. We do not discriminate on the basis of various legally protected characteristics, including criminal history, and strive to provide reasonable accommodations to qualified individuals with disabilities. We prioritize safety and security and may use your information accordingly, and you can contact us for assistance or accommodations during the job application process.

Pay Transparency: At OpenSesame, we prioritize pay transparency, fairness, and equity to create a positive and inclusive work environment, regularly reviewing our compensation practices to align with our values and goals. We provide competitive and fair compensation to our employees based on their skills, experience, and performance.

CPRA (California Candidates): When you submit your application, OpenSesame may collect and use your personal information in accordance with our privacy policy and the CPRA. This may include personal details and employment history, and will only be used for employment-related purposes. We may share this information with third-party service providers, but we will not sell it to third parties. If you have any questions or concerns, please contact us, and for more information on your rights under the CPRA, refer to our privacy policy or the California Attorney General's website.

Originally posted on Himalayas

Listing provenance

Where did this job come from?

See where this vacancy came from and whether more than one current source can still support it. Source names help with traceability and attribution; they are not endorsements or guarantees.

Current source evidenceEstablished source evidence

At least one enabled source recently observed the vacancy. The source chain is traceable, but this is not independent employer verification.

Continuity
One recent renewable source
Source-class independence
One renewable source class
Last source observation
Observed today

This records when High Paid Job last observed the vacancy in source evidence. It confirms source presence, not that the employer edited the vacancy at that time.

  • 1 enabled source recently observed this vacancy.

Source confidence is about traceability and continuity. It is separate from application safety and should not be read as an employer reputation rating.

HimalayasPublisher source

The vacancy is supplied by an external job publisher. Source information helps show where the listing came from; it is not a guarantee about the employer or vacancy.

Continue to applicationOpens in a new tab

Listing source: Himalayas. Destination: himalayas.app. The application opens in a new tab so you can keep this report open.