Senior AppSec & Product Security Engineer (Remote)

OpenKrill; United States; Remote; USD 160,000 - 180,000; Full time

Benefits offered by this job

Remote work environment

Health benefits

401k match

Paid parental leave

Flexible PTO

HSA and FSA options

Employee Assistance Program

Job summary

Cleo Communications US, LLC is seeking a Senior Product Security Engineer to lead and mature security across the product lifecycle, including SSDLC, vulnerability management, and incident response. You will bolster secure defaults, RBAC, and customer-facing advisories while collaborating with Product, CTO, and Architecture to prioritize and ship security features.

The role emphasizes threat modeling for AI-enabled features, rigorous testing, and coordinated disclosure.

Qualifications

• 6+ years in application security, product security, or secure software engineering, with experience maturing an AppSec program across multiple teams.
• Strong object-oriented developer: proficient in an OO language; Java preferred; read, debug, and write production code; comfortable with TypeScript, Python, or Go.
• Deep knowledge of application attack surfaces: authentication, authorization, API security, business-logic flaws, modern service architectures.
• Hands-on experience integrating and tuning SAST, SCA, and secrets scanning in GitHub and CI/CD pipelines.
• Hands-on exploit reproduction and patch validation: reproduce vulnerabilities, confirm fixes, and document communications.
• Coordinated disclosure experience with external researchers and customers, including CVE timelines.
• Product security experience on shipped software with an installed base: defaults, hardening guidance, advisories, and customer RFIs.
• Experience running threat modeling, design reviews, and manual security testing with developers for remediation.
• Clear communicator who can translate risk into engineering guidance and gate releases with leadership.

Responsibilities

• Own SSDLC maturation: security requirements, threat modeling, and design reviews for high-risk changes, APIs, and integrations.
• Run risk-based triage, remediation, and verification for vulnerabilities; reproduce externally reported issues and validate patches.
• Own the penetration testing program: scope engagements, perform testing, and validate findings.
• Run Vulnerability Disclosure Program including researcher communications and coordinated disclosure.
• Coordinate CVE lifecycle for Cleo products and support product-security incident response.
• Own security controls in Cleo's NIST CSF 2.0 program: track maturity, close gaps, provide audit evidence.
• Own security posture across SaaS and customer-hosted deployments: secure defaults, access controls, hardening guidance.
• Roadmap security features with Product Management and CTO, including SSO/SAML upgrades, RBAC redesign, and customer-requested controls.
• Triage customer vulnerability scans and reports, answer RFIs, author advisories and release notes.

Skills

AppSec program leadership

Java

TypeScript

Python

Go

CI/CD pipelines

SAST/SCA integration

Threat modeling

Vulnerability remediation

Security training

Tools

Snyk

GitHub Advanced Security

Semgrep

Burp Suite

CycloneDX

SPDX

AWS

Kubernetes

Terraform

Jenkins

Job description

Cleo Communications US, LLC is seeking a Senior Product Security Engineer to lead and mature security across the product lifecycle, including SSDLC, vulnerability management, and incident response. You will bolster secure defaults, RBAC, and customer-facing advisories while collaborating with Product, CTO, and Architecture to prioritize and ship security features.

The role emphasizes threat modeling for AI-enabled features, rigorous testing, and coordinated disclosure.