Staff Application & Product Security Engineer (Fully Remote)

Cleo; United States; Remote; USD 160,000 - 180,000; Full time

Benefits offered by this job

Healthcare

Flexible PTO

401k match

Parental leave

Remote US

Job summary

Cleo is seeking the most senior hands-on AppSec engineer to own product security from design to release. You will report to the CISO and partner with Engineering and Cloud Security.

Responsibilities include owning SSDLC, threat modeling, automating SAST/SCA/container and IaC scanning, and leading vulnerability triage, pen tests, CVE lifecycle, and security posture for our products in a remote US role.

Qualifications

• Experience owning SSDLC and threat modeling across a product lifecycle.
• Proven ability to automate security testing (SAST/SCA/IAAC/containers).
• Hands-on vulnerability triage, pen testing, and CVE management.

Responsibilities

• Own SSDLC and threat modeling for core products.
• Automate SAST/SCA/container/IaC scanning and integrate security tests into CI/CD.
• Run vulnerability triage, perform pen tests, manage CVE lifecycle, and monitor security posture.

Skills

Threat modeling

SSDLC

Automated scanning

SAST

SCA

Container scanning

IaC scanning

Penetration testing

Tools

SAST tools

Security scanning

CVE lifecycle management

Job description

• Most senior hands-on AppSec engineer, owning product security from design to release.
• Reports to CISO, partners with Engineering and Cloud Security.

Responsibilities:

• Own SSDLC, threat modeling, and automate SAST/SCA/container/IaC scanning.
• Run vulnerability triage, pen tests, CVE lifecycle, and product security posture.

Offer:

• $160K-$180K + bonus, healthcare, flexible PTO, 401k match, parental leave.
• Remote US, supportive culture.

Cleo

Cleo provides secure data integration and managed file transfer solutions for enterprise businesses. With over 4,000 clients and a 99% retention rate, the company promotes a supportive, life-work balanced culture.