Senior Staff AppSec Engineer - Product Security (Remote)

Cleo (US); Chicago (IL); Remote; USD 160,000 - 180,000; Full time

Benefits offered by this job

Great Healthcare

Flexible PTO

Remote work environment

Accelerated title and salary growth

Job summary

Cleo is seeking a Staff Application & Product Security Engineer to lead security by design for our on-premise and SaaS products. You will own SSDLC, threat modeling, and security tests, partnering with Engineering and our Cloud Security team.

You’ll guide developers through remediation, drive secure patterns, and mentor security champions across squads. You will report to the CISO and shape the security posture of Cleo’s products while coordinating with Product, CTO, and Architecture teams to

Qualifications

• 6+ years in application security or product security.
• Strong OO development background, Java preferred; read, debug & write production code across languages.
• Hands-on experience integrating SAST, SCA, and secrets scanning in CI/CD.
• Experience coordinating vulnerability disclosures and CVE processes.
• Product security in shipped software with secure defaults & customer-facing advisories.
• Clear communicator who translates risk into engineering guidance.

Responsibilities

• Own SSDLC: security requirements, threat modeling, design reviews for high-risk changes, APIs & integrations.
• Run and tune SAST, SCA, secrets detection, container & IaC scanning; build reusable secure patterns.
• Own developer security enablement: security champions, training campaigns, and self-service security capabilities.
• Lead risk-based triage, remediation & verification for vulnerabilities; validate patches before release.
• Own penetration testing program: scope third-party engagements and retest findings.
• Coordinate CVE lifecycle & vulnerability disclosure program.
• Own security controls in product-security programs across SaaS and on-prem deployments.

Skills

AppSec leadership

Threat modeling

SSDLC

SAST/SCA

CI/CD integration

Education

BS in Computer Science

Tools

Snyk

GitHub Advanced Security

Semgrep

Burp Suite

Job description

Cleo is seeking a Staff Application & Product Security Engineer to lead security by design for our on-premise and SaaS products. You will own SSDLC, threat modeling, and security tests, partnering with Engineering and our Cloud Security team.

You’ll guide developers through remediation, drive secure patterns, and mentor security champions across squads. You will report to the CISO and shape the security posture of Cleo’s products while coordinating with Product, CTO, and Architecture teams to