Senior AppSec Engineer — Remote, Own Secure Product Releases

Cleo; United States; Remote; USD 160,000 - 180,000; Full time

Benefits offered by this job

Healthcare

Flexible PTO

401k match

Parental leave

Remote US

Job summary

Cleo is seeking the most senior hands-on AppSec engineer to own product security from design to release. You will report to the CISO and partner with Engineering and Cloud Security.

Responsibilities include owning SSDLC, threat modeling, automating SAST/SCA/container and IaC scanning, and leading vulnerability triage, pen tests, CVE lifecycle, and security posture for our products in a remote US role.

Qualifications

• Experience owning SSDLC and threat modeling across a product lifecycle.
• Proven ability to automate security testing (SAST/SCA/IAAC/containers).
• Hands-on vulnerability triage, pen testing, and CVE management.

Responsibilities

• Own SSDLC and threat modeling for core products.
• Automate SAST/SCA/container/IaC scanning and integrate security tests into CI/CD.
• Run vulnerability triage, perform pen tests, manage CVE lifecycle, and monitor security posture.

Skills

Threat modeling

SSDLC

Automated scanning

SAST

SCA

Container scanning

IaC scanning

Penetration testing

Tools

SAST tools

Security scanning

CVE lifecycle management

Job description

Cleo is seeking the most senior hands-on AppSec engineer to own product security from design to release. You will report to the CISO and partner with Engineering and Cloud Security.

Responsibilities include owning SSDLC, threat modeling, automating SAST/SCA/container and IaC scanning, and leading vulnerability triage, pen tests, CVE lifecycle, and security posture for our products in a remote US role.