Job description

ABOUT THE COMPANY Valon is the leading AI platform for mortgage servicing, building the AI-native operating system for regulated finance. Before providing the system of record that powers the entire industry, we built and ran our own mortgage servicer on it. That gave us a real regulated environment to prove our technology could replace the mainframe systems servicers have used for decades. Carrington acquired that servicer and adopted ValonOS as its core platform, allowing us to focus entirely on scaling our SaaS platform. ValonOS is now on track to power 1 in 6 U.S. mortgages across major mortgage servicers like Newrez, Carrington, and ServiceMac. Every process on the platform is structured and programmable, enabling our AI agents to perform core servicing work, like handling payments, escrow, and homeowner questions, directly within the system's controls. We recently raised a $150 million Series D at a $2.3 billion valuation by new investor Ribbit Capital, with continued support from existing backer a16z, amongst others. SECURITY AT VALON Our customers entrust us with some of their most sensitive and personal financial information, and it is the ultimate mission of Valon’s Security team to ensure we have sound programs, processes, and automation in place to safeguard our customers’ data. The Security team protects the infrastructure and data for processing billions of dollars of mortgage loans. In addition to protecting Valon’s internal systems, the Security team partners closely with Product and Engineering to design and deliver secure, scalable, and trustworthy capabilities for ValonOS. We work cross-functionally across all teams at Valon to enable security throughout the organization. We engage with external security auditors, pentesting firms, and partners to continuously evaluate Valon’s security posture. Valon offices are located in New York City and San Francisco, but we fully support remote work! ABOUT THE ROLE We are seeking an experienced and skilled Senior Security Engineer, Threat & Offensive Security to join our growing team! As a key security member at Valon, you will help scale and strengthen our offensive security and threat operations, proactively identifying weaknesses in our systems, networks, and applications as the company continues to grow. This position requires a deep understanding of adversarial techniques, security testing methodologies, threat intelligence, and incident response, along with the ability to collaborate with cross-functional teams. Importantly, this role requires an AI and automation-first approach to security work, using modern tools to scale testing, threat management, and response. You will help ensure security is embedded across our environment and that we continue to safeguard our most critical assets and maintain the trust of our customers and stakeholders. RESPONSIBILITIES - Drive and conduct security testing and penetration tests across applications, infrastructure, and networks to identify exploitable vulnerabilities - Manage and implement security testing tools and frameworks to simulate real-world attacks and validate the effectiveness of existing security controls - Design and implement AI-enabled workflows to scale security testing and threat related operations. - Manage and operationalize threat intelligence to anticipate emerging threats and adjust defenses proactively - Partner with external pentesting firms for periodic, independent reviews - Perform security reviews of new systems, features, architectures, and third-party integrations, providing actionable risk-based recommendations - Collaborate with Engineering, IT, Product and other teams to remediate identified vulnerabilities and strengthen security controls - Develop and refine playbooks, procedures, and standards for offensive security testing, threat monitoring, and incident response - Monitor and manage security alerts and incidents, analyze data, and respond to security events - Support operational activities including general security reviews, security monitoring, vendor security, issue remediation, security awareness, audit/compliance, and other processes IDEAL BACKGROUND - Proven experience in security engineering, red team, or threat management role, with a focus on penetration testing, security testing, threat intelligence, and/or incident response - Hands-on experience with security testing tools and frameworks (e.g., Burp Suite, Metasploit, Nmap, Cobalt Strike, or similar) - Demonstrated experience leveraging AI and automation to improve the efficiency and scalability of threat detection, testing, and response operations - Proficient in both manual and automated testing techniques, understanding when manual analysis is needed versus pure automated testing - Strong understanding of common attack techniques, exploitation methods, and MITRE ATT&CK or related - Experience with SIEM, EDR, and other detection/monitoring platforms - Experience with cloud security and environments (GCP, AWS) - Ability to work autonomously, lead projects, and navigate complex, ambiguous security investigations - Ability to foster strong relationships and partner with stakeholders to drive remediation and results - Excellent communication and collaboration skills, with the ability to explain technical findings and risk to both technical and non-technical stakeholders - Applied knowledge of industry security and testing frameworks (OWASP, NIST, MITRE ATT&CK, CIS, SOC 2/ISO 27001 concepts) - Experience or exposure to startup environments is a plus MINIMUM QUALIFICATIONS - Minimum of 5 years in a security engineering, penetration testing, threat intelligence, or similar roles with relevant responsibilities and background - Bachelor's degree in Computer Science, Information Security, Technology, or a related field - Relevant security certifications (e.g., CISSP, CEH, OSCP, GPEN, GCIH or similar) - Knowledge of cloud environments - Experience with security testing, monitoring, and response technologies (threat intelligence platforms, vulnerability scanners, SIEM, EDR, or similar) BENEFITS - Compensation: competitive salary with a meaningful stake in the company via equity, and 401(k) plan. The base salary range reflects multiple levels. We assess level based on a combination of experience and interview performance. - Health & well-being: we’ll invest in your physical and mental well-being with comprehensive medical, dental, & vision benefits. - Free Food: daily lunch, and dinner provided through Forkable for in-office team members. - Commuter benefits: pre-tax deductions for public transit, rideshares, and parking to simplify your daily commute. - Grow together: company wide orientation for you to successfully onboard and other learning & development opportunities including regular review cycles that feature 360-degree feedback. - Play together: quarterly budgets for team and company outings. Use it for team swag, cooking classes, or team dinners. - Generous time off: flexible paid time off with no annual limit, sick days, and 11 company holidays. - Baby bonding time: 12 weeks of fully paid leave for both birthing and non-birthing parents, so you can spend uninterrupted time welcoming and caring for your newest family member. Throughout the interview process, please remember that emails will only be from valon.com valon.com email addresses. We will never ask for any personally identifiable information during the interview process itself. Please reach out to talent@valon.com if you have any requests to verify the authenticity of an outreach. Valon is an equal opportunity employer that is committed to diversity and inclusion in the workplace. We prohibit discrimination and harassment of any kind based on race, color, sex, religion, sexual orientation, national origin, disability, genetic information, pregnancy, or any other protected characteristic as outlined by federal, state, or local laws. Valon makes hiring decisions based solely on qualifications, merit, and business needs at the time.

Requirements

Must-haves

Valon offices are located in New York City and San Francisco, but we fully support remote work!
Drive and conduct security testing and penetration tests across applications, infrastructure, and networks to identify exploitable vulnerabilities
Manage and implement security testing tools and frameworks to simulate real-world attacks and validate the effectiveness of existing security controls
Design and implement AI-enabled workflows to scale security testing and threat related operations.
Manage and operationalize threat intelligence to anticipate emerging threats and adjust defenses proactively
Partner with external pentesting firms for periodic, independent reviews
Perform security reviews of new systems, features, architectures, and third-party integrations, providing actionable risk-based recommendations
Collaborate with Engineering, IT, Product and other teams to remediate identified vulnerabilities and strengthen security controls
Develop and refine playbooks, procedures, and standards for offensive security testing, threat monitoring, and incident response
Monitor and manage security alerts and incidents, analyze data, and respond to security events
Support operational activities including general security reviews, security monitoring, vendor security, issue remediation, security awareness, audit/compliance, and other processes
Proven experience in security engineering, red team, or threat management role, with a focus on penetration testing, security testing, threat intelligence, and/or incident response
Hands-on experience with security testing tools and frameworks (e.g., Burp Suite, Metasploit, Nmap, Cobalt Strike, or similar)
Demonstrated experience leveraging AI and automation to improve the efficiency and scalability of threat detection, testing, and response operations
Proficient in both manual and automated testing techniques, understanding when manual analysis is needed versus pure automated testing
Strong understanding of common attack techniques, exploitation methods, and MITRE ATT&CK or related
Experience with SIEM, EDR, and other detection/monitoring platforms
Experience with cloud security and environments (GCP, AWS)
Ability to work autonomously, lead projects, and navigate complex, ambiguous security investigations
Ability to foster strong relationships and partner with stakeholders to drive remediation and results
Excellent communication and collaboration skills, with the ability to explain technical findings and risk to both technical and non-technical stakeholders
Applied knowledge of industry security and testing frameworks (OWASP, NIST, MITRE ATT&CK, CIS, SOC 2/ISO 27001 concepts)
Minimum of 5 years in a security engineering, penetration testing, threat intelligence, or similar roles with relevant responsibilities and background

Nice-to-haves

Experience or exposure to startup environments is a plus

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

aigcpaws

Platform: ashby
Effort: quick

Benefits

Benefits detected in the listing.

Dental

Vision

401(K)

Paid Time Off