Staff Application & Product Security Engineer
Cleo · Remote US
About this role
**Staff Application & Product Security Engineer** **You’ll do** - Own and mature Cleo’s SSDLC: security requirements, threat modeling, and design reviews for high-risk product changes, APIs, and integrations. - Run and tune SAST, SCA, secrets detection, container, and IaC scanning. - Build reusable secure patterns, reference implementations, and policy-as-code controls that make the secure path the default path. - Own developer security enablement: Security Champions meetings, engineering security training campaigns, grow a named champion in every squad, and provide practical remediation guidance, office hours, and self-service security capabilities. **Product vulnerability management** - Run risk-based triage, remediation, and verification for application and product vulnerabilities, including remediation SLAs, escalation, and exceptions. - Reproduce externally reported vulnerabilities against running product instances and validate patches before release. - Own the penetration testing program: scope and coordinate third-party engagements, perform targeted testing yourself, and validate findings through retesting. - Run Cleo’s Vulnerability Disclosure Program, including researcher communications and coordinated disclosure. - Coordinate the CVE lifecycle for Cleo products and support product-security incident response.
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.