Staff Application & Product Security Engineer

Cleo is hiring a Staff Application & Product Security Engineer to lead application and product security across its SaaS and on-premise products. The role owns the secure software development lifecycle, vulnerability management, product security roadmap, AI security controls, and security collaboration with engineering and product teams.

Responsibilities:

• Own and mature Cleo’s SSDLC: security requirements, threat modeling, and design reviews for high-risk product changes, APIs, and integrations
• Run and tune SAST, SCA, secrets detection, container, and IaC scanning
• Build reusable secure patterns, reference implementations, and policy-as-code controls that make the secure path the default path
• Own developer security enablement: Security Champions meeting, deliver the engineering security training campaigns, grow a named champion in every squad, and give developers practical remediation guidance, office hours, and self-service security capabilities
• Run risk-based triage, remediation, and verification for application and product vulnerabilities, including remediation SLAs, escalation, and exceptions. Reproduce externally reported vulnerabilities against running product instances and validate patches before release
• Own the penetration testing program: scope and coordinate third-party engagements, perform targeted testing yourself, and validate findings through retesting
• Run our Vulnerability Disclosure Program, including researcher communications and coordinated disclosure
• Coordinate the CVE lifecycle for Cleo products and support product-security incident response
• Own the application and product-security controls in Cleo's NIST CSF 2.0 program: track maturity, close gaps, and produce the evidence our audits rely on
• Own the security posture of the products Cleo ships, across SaaS and customer-hosted deployment models: secure defaults, authentication and session controls, RBAC and tenant isolation, admin data access, security-relevant configuration, and hardening guidance for customers
• Own the Product Security Roadmap: partner with Product Management, the CTO, and Architecture to get security features prioritized and shipped, including SSO/SAML upgrades, the in-app RBAC redesign, endpoint-level access control, and customer-requested controls, and represent security in RTE Sync and Boundary Review
• Be the technical owner for customer-facing product security: triage customer vulnerability-scan findings and penetration-test reports against Cleo products, answer security RFIs and enhancement requests, and author customer-facing advisories, security release notes, and hardening documentation
• Own threat modeling and security review for LLM-enabled product features, AI agents, and AI-assisted development workflows
• Build controls and secure patterns for prompt injection, sensitive data exposure, insecure output handling, excessive agency, insecure tool integrations, and AI supply-chain risk
• Apply and operationalize the OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework across product and engineering

Requirements:

• 6+ years in application security, product security, or secure software engineering, including experience building or maturing an AppSec program across multiple engineering teams
• Strong proficiency in an object-oriented programming language is required
• You should be able to read, debug, and write production-quality code and be comfortable working across languages such as TypeScript, Python, or Go
• Deep knowledge of application attack surfaces: authentication, authorization, API security, business-logic flaws, and modern service architectures
• Hands-on experience integrating and tuning SAST, SCA, and secrets scanning in GitHub and CI/CD pipelines
• Hands-on exploit reproduction and patch validation: you can take a researcher's report of a pre-authentication vulnerability, reproduce it against a running Java web application, confirm the fix, and write up what the researcher and the customer each need to hear
• Coordinated disclosure experience with external security researchers and customers, including holding an embargo timeline and driving a CVE to publication
• Product security experience on shipped software with an installed base: secure defaults and hardening guidance, customer-facing advisories and security release notes, and turning a customer's scan report or RFI into a fix-or-explain response
• Experience running threat modeling, design reviews, and manual security testing, and working directly with developers through remediation
• Clear communicator who can turn technical risk into engineering guidance for both developers and executives, and who can hold a release-gating decision with Engineering leadership when the risk warrants it
• Java preferred given Cleo's core products are Java-based
• Securing LLM applications, AI agents, or AI-assisted development tools
• SBOM (CycloneDX/SPDX), VEX, artifact signing, and SLSA
• AWS, Kubernetes/EKS, Terraform, Jenkins
• Snyk, GitHub Advanced Security, Semgrep, Burp Suite
• NIST CSF 2.0, OWASP SAMM/ASVS, NIST SSDF; supporting SOC 2 or ISO 27001 audits
• CSSLP, OSWE, GWAPT, AWS Security, or comparable certifications
• Enterprise software with both SaaS and customer-hosted deployment models; SSO/SAML, RBAC design, and multi-tenant isolation; MFT/EDI or other B2B integration products