Senior AppSec Engineer: Product & Cloud Security

Cleo (India); United States; Remote; USD 160,000 - 180,000; Full time

Benefits offered by this job

Great Healthcare + Dental + Vision

Flexible PTO

401k match

Remote work environment

Employer 401k match

Life‑Work balance support

Job summary

Cleo Communications US, LLC is seeking a Staff‑level Application Security Engineer to own security across design, release, and operations for SaaS and on‑prem products. You will guide secure defaults, RBAC, and customer‑facing advisories, reporting to the CISO and collaborating with Engineering and Cloud Security teams.

The role emphasizes building guardrails, driving threat modeling, and maturing processes with automation and partnerships, while influencing a broad security program across

Qualifications

• 6+ years in application security, product security, or secure software engineering
• Strong proficiency in an object‑oriented programming language (Java preferred) with reading/writing production‑quality code
• Deep knowledge of authentication, authorization, API security, and service architectures
• Hands‑on experience integrating and tuning SAST, SCA, and secrets scanning in GitHub and CI/CD pipelines
• Hands‑on exploit reproduction and patch validation with pre‑authentication vulnerability reports
• Coordinated disclosure experience with external researchers and customers and CVE lifecycle management
• Experience securing SaaS and on‑prem deployments with RBAC, multi‑tenant isolation, and hardening guidance
• Ability to turn technical risk into engineering guidance for developers and executives

Responsibilities

• Own and mature the SSDLC, including security requirements, threat modeling, and design reviews for high‑risk changes
• Run and tune SAST, SCA, secrets detection, container, and IaC scanning
• Build reusable secure patterns and policy‑as‑code controls that default to the secure path
• Own developer security enablement: security champions program, training campaigns, and self‑service security capabilities
• Run risk‑based triage, remediation, and verification for vulnerabilities with SLAs
• Own penetration testing program: scope third‑party engagements, perform targeted testing, retest findings
• Run Vulnerability Disclosure Program, coordinate CVE lifecycle, and incident response
• Triage customer vulnerability scans and advisories; author security release notes and hardening docs
• Own security posture for products across SaaS and customer‑hosted deployments

Skills

Threat modeling

Secure software engineering

SAST/SCA integration

CI/CD security

Security leadership

Tools

Snyk

GitHub Advanced Security

Semgrep

Burp Suite

AWS

Job description

Cleo Communications US, LLC is seeking a Staff‑level Application Security Engineer to own security across design, release, and operations for SaaS and on‑prem products. You will guide secure defaults, RBAC, and customer‑facing advisories, reporting to the CISO and collaborating with Engineering and Cloud Security teams.

The role emphasizes building guardrails, driving threat modeling, and maturing processes with automation and partnerships, while influencing a broad security program across