Staff AppSec Engineer — Secure Product & APIs (Remote)

Cleo (US); United States; Remote; USD 160,000 - 180,000; Full time

Benefits offered by this job

Remote work environment

Bonus Opportunity

Great Healthcare + Dental + Vision

Flexible PTO

Job summary

Cleo (US) is seeking a Staff Application & Product Security Engineer to own security across design through release for both on-premise and SaaS products. As the most senior hands-on security engineer, you set standards, build guardrails, and work directly with engineers, reporting to the CISO and partnering with Engineering and Cloud Security.

You will lead SSDLC, threat modeling, vulnerability management, and product security posture across SaaS and customer-hosted deployments, deliver

Qualifications

• 6+ years in application security, product security, or secure software engineering.
• Strong OO developer: Java preferred, read/write production code; also TypeScript, Python or Go.
• Deep knowledge of authentication, authorization, API security, and modern service architectures.
• Hands-on experience integrating and tuning SAST, SCA, and secrets scanning in GitHub and CI/CD pipelines.
• Experience coordinating vulnerability disclosures, CVEs, and external security researchers.

Responsibilities

• Own and mature SSDLC: security requirements, threat modeling, and design reviews for high-risk changes, APIs, and integrations.
• Run and tune SAST, SCA, secrets detection, container, and IaC scanning.
• Build reusable secure patterns and policy-as-code controls to make secure paths the default.
• Own developer security enablement: security champion program, engineer training campaigns, and self-service security capabilities.

Skills

6+ years AppSec

Java

TypeScript

Python

Go

OO programming

Tools

Snyk

GitHub Advanced Security

Semgrep

Burp Suite

SAST tooling

SCA tooling

Job description

Cleo (US) is seeking a Staff Application & Product Security Engineer to own security across design through release for both on-premise and SaaS products. As the most senior hands-on security engineer, you set standards, build guardrails, and work directly with engineers, reporting to the CISO and partnering with Engineering and Cloud Security.

You will lead SSDLC, threat modeling, vulnerability management, and product security posture across SaaS and customer-hosted deployments, deliver