Staff Application & Product Security Engineer

cleo; United States; Remote; USD 160,000 - 180,000; Full time

Benefits offered by this job

Bonus opportunity

Remote work

Health coverage

Dental coverage

Vision coverage

401(k) match

Flexible PTO

Parental leave

Job summary

cleo is seeking a staff-level security specialist to own and mature the secure software development lifecycle for our Java-based platform, deployed as SaaS and on-premises. You will lead threat modeling, security requirements, design reviews, and policy-as-code guardrails to make the secure path the default.

You will drive SAST/SCA, secrets detection, container and IaC scanning, plus CVE lifecycle management and disclosure programs, partnering with engineering and product leadership to ship

Qualifications

• 6+ years in application security, product security, or secure software engineering.
• Experience building or maturing an AppSec program across multiple engineering teams.
• Strong proficiency in Java; able to read, debug, and write production-quality code in Java/TypeScript/Python/Go.
• Deep knowledge of authentication, session management, access control, and multi-tenant isolation.
• Experience running threat modeling, design reviews, and remediation with developers.
• Track record of vulnerability disclosure coordination and customer advisories.

Responsibilities

• Own and mature the secure software development lifecycle with threat modeling and policy-as-code guardrails.
• Operate and tune SAST, SCA, secrets detection, container and IaC scanning; build secure patterns and references.
• Lead risk-based triage, remediation, and CVE lifecycle management for product vulnerabilities.
• Coordinate third-party penetration tests and reproduce issues against running product instances; lead disclosure program.
• Threat-model LLM-enabled features, AI agents, and AI-assisted workflows following OWASP Top 10 for LLM apps and NIST AI RMF.
• Serve as technical owner for customer-facing product security; triage scan findings, answer RFIs, publish advisories, drive security roadmap (SSO/SAML upgrades, RBAC redesign).

Skills

Threat modeling

Security architecture

Communication skills

Code review

Java

TypeScript

Python

Go

Tools

AWS

Kubernetes

Terraform

Jenkins

Snyk

GitHub Advanced Security

Semgrep

Burp Suite

Job description

Role overview

Staff-level individual contributor focused on application and product security for a Java-based software platform deployed as both SaaS and on-premise. Sets the technical direction for secure development, owns the product security posture customers experience, and partners with engineering, cloud security, and product leadership to ship secure features at scale.

Responsibilities

• Own and mature the secure software development lifecycle: threat modeling, security requirements, design reviews, and policy-as-code guardrails that make the secure path the default.
• Operate and tune SAST, SCA, secrets detection, container, and infrastructure-as-code scanning, building reusable secure patterns and reference implementations.
• Run risk-based triage, remediation, and verification for product vulnerabilities, including remediation SLAs, escalation paths, and CVE lifecycle management.
• Coordinate third-party penetration tests, reproduce externally reported issues against running product instances, and lead the vulnerability disclosure program.
• Threat-model LLM-enabled features, AI agents, and AI-assisted developer workflows, applying OWASP Top 10 for LLM Applications and the NIST AI RMF.
• Serve as the technical owner for customer-facing product security: triage customer scan findings, answer security RFIs, author advisories, and drive security roadmap items such as SSO/SAML upgrades and RBAC redesigns.

Requirements

• 6+ years in application security, product security, or secure software engineering, with experience building or maturing an AppSec program across multiple engineering teams.
• Strong proficiency in an object-oriented language, ideally Java, with the ability to read, debug, and write production-quality code across Java, TypeScript, Python, or Go.
• Deep knowledge of application attack surfaces, including authentication, session management, access control, and multi-tenant isolation.
• Experience running threat modeling, design reviews, manual security testing, and working with developers through remediation.
• Track record of running a vulnerability disclosure program, coordinating CVEs, and producing customer-facing security advisories and hardening documentation.
• Clear communication skills with the ability to translate technical risk into guidance for developers and executives and to hold a release-gating decision when needed.

Nice to have

• Securing LLM applications, AI agents, or AI-assisted development tools.
• SBOM tooling (CycloneDX/SPDX), VEX, artifact signing, and SLSA.
• AWS, Kubernetes/EKS, Terraform, Jenkins, and tools such as Snyk, GitHub Advanced Security, Semgrep, or Burp Suite.
• Familiarity with NIST CSF 2.0, OWASP SAMM/ASVS, NIST SSDF, and supporting SOC 2 or ISO 27001 audits.
• Certifications such as CSSLP, OSWE, GWAPT, or AWS Security.
• Background in enterprise software supporting both SaaS and customer-hosted deployments, including MFT/EDI or B2B integration products.

Benefits and work setup

• Compensation range of $160,000 to $180,000 plus bonus opportunity.
• Health, dental, and vision coverage, FSA and HSA options, and an Employee Assistance Program.
• Flexible PTO, paid parental leave, 401(k) match, and a remote work environment.