Security-first compliance built by ex-pentesters: SOC 2 and ISO 27001 without the theater.
The company went through Y Combinator's Summer 2022 batch, calls itself YC's most popular compliance platform, and told TechCrunch that two-thirds of new YC portfolio companies become customers; the site now says 1,000+ teams. It grew to $9M ARR profitably without touching its seed money, then raised a $33M Series A led by Dawn Capital in October 2025, with Y Combinator, former Snowflake and ServiceNow CEO Frank Slootman and Dropbox co-founder Arash Ferdowsi, for $35M raised in total. YC lists the team at 75 people.
Oneleet is a security and compliance platform for startups and scale-ups that need SOC 2, ISO 27001, HIPAA, GDPR, PCI or DORA to close enterprise deals. Its pitch is that most compliance is theater: certifications on paper, vulnerability scans marketed as pentests, screenshots to tick boxes. So it bundles compliance automation with the security work itself, including in-house penetration testing, code scanning, cloud security posture management, attack surface monitoring, device management, security training and vCISO guidance, and it handles the back-and-forth with external auditors. The stated order is security first, compliance follows.
Bryan Onel, CEO and co-founder. Ethical hacker who spent a decade running penetration tests for more than 150 companies, first at Sogeti Nederland (2014-2015) and then as a freelance pentester and security consultant in Amsterdam (2015-2022), and holds OSCP and CISSP certifications. He studied at Vrije Universiteit Amsterdam, where he took a BSc in Artificial Intelligence alongside degrees in Medicine and Law; his father was a locksmith, and he describes himself as the digital equivalent.
Ora Onel, Co-founder. Bryan's wife, with a background in medical genetics rather than security. She taught biology in London at Hasmonean High School and London Academy (2015-2019), and holds a BSc in Human Biology from Loughborough University, a PGCE from Middlesex University and a postgraduate certificate in Genomic Medicine from Imperial College London.
Erik Vogelzang, Co-founder. Bryan's college friend and the third co-founder. Trained in law and medicine: an LL.M. from Vrije Universiteit Amsterdam, then an MSc and a PhD in Medicine, and a residency in medical microbiology at VUmc in Amsterdam (2017-2022) before Oneleet.
Oneleet is a remote-first company with its founders and office in Amsterdam, Netherlands, and its legal registration in Wilmington, Delaware. It hires globally, directly or through an employer-of-record partner: engineering roles are posted as remote in the United States and the EU, and most go-to-market roles are remote in the United States.
Describe your next role, cut the noise
Candidates must have 5+ years of experience in GTM operations, revenue operations, or analytics engineering within a B2B SaaS environment. Strong technical proficiency in SQL, BigQuery, and marketing tracking technologies is required to diagnose and resolve data discrepancies.
Remote US or Europe. Company hires globally where legally possible, but this role’s listed location is US/EU remote.
Candidates must have 3-6+ years of experience in event marketing, community management, or related fields within a B2B SaaS environment. Strong organizational skills, proven experience in event production, and the ability to align community initiatives with business revenue goals are essential.
Remote-first. Can work from Ottawa (CA), London (UK), US, or Amsterdam (EU); may prefer proximity to San Francisco for community events.
Candidates should have experience building security programs from scratch and a strong working knowledge of major compliance frameworks like ISO 27001 and SOC 2. Technical fluency in JSON and basic scripting for automation is required.
Remote in the United States; non-US candidates considered via compliant EOR arrangements.
Requires 2-4 years of experience with Go and PostgreSQL in a fast-paced startup environment. Candidates should be pragmatic builders comfortable with SaaS backends and operating outside a standard 9-5 schedule.
Remote US and European Union. No other regional restrictions mentioned; remote-first global EOR possible outside US.
Requires 2-4 years of fullstack experience with expertise in Go, JavaScript/TypeScript, and building production APIs. Candidates must have a proven track record of creating intuitive user interfaces and strong debugging skills across the full stack.
Remote-first in the United States and European Union (EU only). No other regions listed.
Requires 4+ years of experience in information security, compliance, or audit, with a deep understanding of frameworks like SOC 2 and ISO 27001. Candidates must have technical account management experience and the ability to translate complex security concepts for diverse stakeholders.
Remote US only; US-based candidates; E-Verify for U.S. hires; remote-first with global hiring options.
Candidates should have 5+ years of fullstack software development experience, particularly in Go and JavaScript/TypeScript. Strong experience in building production APIs and user interfaces is essential, along with solid debugging skills across the full stack.
Remote worldwide; US hires may require E-Verify; non-US hires via EOR per location.
Candidates should have over 5 years of application security experience and strong programming skills in languages like Go, Python, or TypeScript. Hands-on experience with security tooling and an understanding of vulnerability research are also essential.
Remote worldwide; global hiring with no location restrictions.
Candidates should have 5+ years of experience with Go and designing REST APIs, along with expertise in writing optimized PostgreSQL queries. Experience in a fast-moving startup environment and excellent communication skills are also essential.
Remote-first; globally hireable where legally permissible via EOR arrangements.
Candidates should have experience with strongly typed compiled languages and backend development, particularly with APIs and data pipelines. Familiarity with authentication standards and cloud provider APIs is preferred.
Remote US only
Candidates should have over 3 years of experience in an information security role and possess a broad knowledge of security best practices and frameworks. Strong analytical and communication skills are essential, along with the ability to work independently in a fast-paced startup environment.
Remote US only
Candidates should have 5+ years of software development experience, particularly in systems programming or security software. Strong expertise in Go and JavaScript, along with a deep understanding of operating systems across multiple platforms, is essential.
Remote-first; globally hiring; work from anywhere with compliant employment arrangements.
Candidates should have 5+ years of frontend engineering experience with expertise in React and TypeScript, along with a strong track record of shipping production UIs. Experience with component libraries, performance optimization, and user feedback is also essential.
Remote US only; non-US candidates may be considered under compliant hiring arrangements.
Candidates should have 3-6 years of experience in content, community, or growth marketing, with exceptional writing skills and a portfolio demonstrating their ability to engage technically sophisticated audiences. A rebellious mindset and the ability to thrive without a playbook are essential.
Remote from US, Canada, UK, or EU; global hiring with compliant local arrangements.
Candidates should have a deep understanding of compliance frameworks such as SOC2 and ISO27001, along with experience in reviewing evidence for compliance audits. Strong attention to detail and excellent written communication skills are essential for documenting findings.
Remote worldwide; can work from any location with global hiring arrangements.
Candidates should have 5+ years of product management experience, particularly in security or technical SaaS companies, and must be comfortable reading technical data. Strong communication skills and the ability to make decisions with imperfect information are essential.
Remote-first; global hiring with potential location-based arrangements; open to candidates worldwide.
Candidates should have 3-6+ years of experience in product marketing or related fields, with a strong portfolio of sales enablement and long-form content. Exceptional writing ability and a solid understanding of B2B SaaS buying cycles are essential.
Remote US only
Candidates should have 3+ years of experience in renewals or account management in B2B SaaS and a proven track record of hitting retention targets. Strong skills in reporting, forecasting, and negotiation are essential, along with the ability to thrive in ambiguity.
Remote-first, globally hireable; work from anywhere with regional pay bands; US/E-Verify compliance.
Candidates should have 5+ years of product design experience, particularly in developer tools, security, or enterprise SaaS. Strong UX instincts and the ability to translate complex data into approachable designs are essential.
Remote US only
Requires 3+ years of experience in renewals or account management within B2B SaaS, with a proven ability to design reporting models. Must be proficient with CRM tools and spreadsheets and comfortable working autonomously in an ambiguous environment.
Remote US only; US-based candidates must be eligible to work in US and pass E-Verify.
Requires 5+ years of product management experience in security, developer tools, or technical SaaS, with a proven track record of shipping products against competitors. Must be comfortable reading technical scanner outputs (like SARIF) and thriving in a fast-paced startup environment.
Remote US only
Requires 5+ years of fullstack experience with expertise in Go, TypeScript, and building production APIs. Candidates must have a proven track record of creating intuitive UIs and the ability to balance technical excellence with rapid feature delivery.
Remote US only
Requires 5+ years of application security experience with strong programming skills in Go, Python, or TypeScript. Must have hands-on experience tuning security tools for production and a pragmatic approach to building in a fast-paced startup environment.
Remote US only
Requires 5+ years of experience with Go and PostgreSQL, with a proven track record of building SaaS platform backends. Candidates should be comfortable in a fast-paced startup environment and possess excellent communication skills.
Remote US only
Foundational, high-impact role in a YC-backed cybersecurity startup, with room to grow, ownership, and startup perks like equity, comprehensive benefits, flexible remote work, and quarterly off-sites.
Remote US or GB; US citizen/visa only.
Hybrid GTM/RevOps engineer role focused on building and optimizing the GTM stack, analytics, and automation using HubSpot, GA4, and Looker Studio.
Remote within US; flexible hours, time-zone aligned.
The growth curve is steep and public. Oneleet went from zero to $7M ARR in 20 months on organic, community-led sales, was growing roughly 300% year on year at the Series A, and in July 2026 the CEO reported the biggest quarter in company history and seven figures of ARR added every month after hiring account executives, switching on paid acquisition and building a GTM engineering function. Current postings describe the company as growing 2x, and the CEO says the next chapter is being built with a crazy amount of ambition and scale in mind.
Many open roles are first hires. The customer support, product marketing, renewals, and community postings all describe building the function from scratch, with no inherited playbook and a direct line to the founders. Product and engineering roles talk to customers and design partners themselves: a product manager owns a new code security suite (SAST, SCA, DAST, IaC scanning, secrets and container scanning) including its free tier and Product Hunt launch, and engineers ship end to end in Go, TypeScript and React rather than handing work across teams.
Compensation is transparent. Every posting on the Ashby board publishes a salary range, and the company explains its geographic pay bands openly: ranges are a US baseline, offers in San Francisco, New York or Zurich can land at or above the top of the range, and offers in cheaper markets are benchmarked lower. Benefits include health and wellness coverage.
The recruiting copy on every posting asks for opinionated rebels: people frustrated with the status quo, decisive but not obstinate, and clear communicators who own their ideas. The stated values are impact over titles, autonomy over micromanagement, and clarity over jargon. The Framework Engineer posting wants someone frustrated with how much security theatre they have seen at past employers, whose job is to help customers meet requirements with, in the company's words, the minimum amount of bullshit required.
Customer urgency runs through the company. Support's published standard is a first response within 15 minutes, because customers cannot afford to wait. The Security Program Manager role is described as high-volume, high-interruption and relationship-oriented. When a rival compliance vendor's customers discovered in 2026 that their documentation might be worthless, CEO Bryan Onel posted that he had been on calls nonstop helping founders and would personally join any customer call where a report was questioned.
The CEO is candid about his own style. The posting for his executive assistant says: "Our CEO moves fast and isn't a natural delegator." His own framing of the business, from the Series A announcement: "compliance gets you in the door, but security is the product. Anyone can automate a checklist... a SOC 2 that doesn't actually make you safer is just paperwork with a badge on it."
Applications go through the Ashby board. Oneleet discloses that AI-assisted tools screen applications, assess qualifications and detect fraudulent submissions, with a human making every final decision; candidates can request the bias audit results or accommodations at recruiting@oneleet.com. The company does not publish an interview stage list, but postings say offers are set by location, skills and experience demonstrated through the interview process. What they screen for is consistent across roles: prior startup experience, scrappiness and pragmatism, comfort operating without a spec, and willingness to work directly with customers and engineers.
Beyond SOC 2 and ISO 27001 it covers HIPAA, GDPR, PCI DSS, EU DORA, HITRUST, CIS IG1, NIST 800-171, CCPA and 21 CFR Part 11, with OSCE-certified pentesters on staff, continuous monitoring, an employee portal, access reviews, a trust center and a security questionnaire tool. It sells to teams from five-person startups to 6,000-person enterprises and names Vanta, Drata, Secureframe and Sprinto as its competitors.
Ranges from current postings, all US baselines before equity: Application Security Engineer $160K to $220K, Fullstack and Backend Engineer $120K to $180K for five-plus years or $90K to $120K for two to four years, Product Manager $130K to $180K, Senior Product Designer $130K to $165K, GTM AI Engineer $100K to $160K, Security Program Manager $75K to $140K, Renewals Account Manager $80K to $105K plus bonus, Customer Support Specialist $50K to $65K, and the Amsterdam executive assistant role €70K to €90K.
Backend services in Go with REST and gRPC APIs on PostgreSQL, a React and TypeScript frontend with a Storybook component library, and workflow engines for queued jobs. The platform integrates with AWS, GCP and Azure, ships an endpoint agent across thousands of devices, and the go-to-market team runs on HubSpot, Dreamdata, PostHog, BigQuery and Looker, with support tickets in Pylon.
There is no published sponsorship policy. US roles posted on the YC job board are marked US citizen or visa holders only, US hires are verified through E-Verify, and candidates outside the US are employed where Oneleet can engage them directly or through an employer of record.
An estimate reported by Reg Tech Post put the Series A valuation between $150M and $200M with about two years of runway. Nicolas Dessaigne, the company's YC group partner, and a group of founders and CISOs invested alongside the institutional backers.
Want remote roles like these in your inbox? Tell us what you are looking for.
Describe your next role, cut the noise