Staff AppSec Engineer: Secure SaaS & On-Prem, Remote

cleo; Stati Uniti; Remoto; USD 160.000 - 180.000; Tempo pieno

Vantaggi offerti da questo lavoro

Bonus opportunity

Remote work

Health coverage

Dental coverage

Vision coverage

401(k) match

Flexible PTO

Parental leave

Descrizione del lavoro

cleo is seeking a staff-level security specialist to own and mature the secure software development lifecycle for our Java-based platform, deployed as SaaS and on-premises. You will lead threat modeling, security requirements, design reviews, and policy-as-code guardrails to make the secure path the default.

You will drive SAST/SCA, secrets detection, container and IaC scanning, plus CVE lifecycle management and disclosure programs, partnering with engineering and product leadership to ship

Competenze

• 6+ years in application security, product security, or secure software engineering.
• Experience building or maturing an AppSec program across multiple engineering teams.
• Strong proficiency in Java; able to read, debug, and write production-quality code in Java/TypeScript/Python/Go.
• Deep knowledge of authentication, session management, access control, and multi-tenant isolation.
• Experience running threat modeling, design reviews, and remediation with developers.
• Track record of vulnerability disclosure coordination and customer advisories.

Mansioni

• Own and mature the secure software development lifecycle with threat modeling and policy-as-code guardrails.
• Operate and tune SAST, SCA, secrets detection, container and IaC scanning; build secure patterns and references.
• Lead risk-based triage, remediation, and CVE lifecycle management for product vulnerabilities.
• Coordinate third-party penetration tests and reproduce issues against running product instances; lead disclosure program.
• Threat-model LLM-enabled features, AI agents, and AI-assisted workflows following OWASP Top 10 for LLM apps and NIST AI RMF.
• Serve as technical owner for customer-facing product security; triage scan findings, answer RFIs, publish advisories, drive security roadmap (SSO/SAML upgrades, RBAC redesign).

Conoscenze

Threat modeling

Security architecture

Communication skills

Code review

Java

TypeScript

Python

Go

Strumenti

AWS

Kubernetes

Terraform

Jenkins

Snyk

GitHub Advanced Security

Semgrep

Burp Suite

Descrizione del lavoro

cleo is seeking a staff-level security specialist to own and mature the secure software development lifecycle for our Java-based platform, deployed as SaaS and on-premises. You will lead threat modeling, security requirements, design reviews, and policy-as-code guardrails to make the secure path the default.

You will drive SAST/SCA, secrets detection, container and IaC scanning, plus CVE lifecycle management and disclosure programs, partnering with engineering and product leadership to ship