Staff Application & Product Security Engineer

Responsibilities

• Secure development lifecycle and guardrails
• Own and mature Cleo’s SSDLC: security requirements, threat modeling, and design reviews for high-risk product changes, APIs, and integrations.
• Run and tune SAST, SCA, secrets detection, container, and IaC scanning.
• Build reusable secure patterns, reference implementations, and policy-as-code controls that make the secure path the default path.
• Own developer security enablement: Security Champions meeting, deliver the engineering security training campaigns, grow a named champion in every squad, and give developers practical remediation guidance, office hours, and self-service security capabilities.
• Product vulnerability management
• Run risk-based triage, remediation, and verification for application and product vulnerabilities, including remediation SLAs, escalation, and exceptions. Reproduce externally reported vulnerabilities against running product instances and validate patches before release.
• Own the penetration testing program: scope and coordinate third-party engagements, perform targeted testing yourself, and validate findings through retesting.
• Run our Vulnerability Disclosure Program, including researcher communications and coordinated disclosure.
• Coordinate the CVE lifecycle for Cleo products and support product-security incident response.

Languages