Staff Application and Product Security Engineer

Job overview

The Staff Application and Product Security Engineer role is described as remote in the United States; compensation is $160,000–$180,000 per year, with a bonus opportunity. Cleo describes its products as serving more than 4,000 clients with a 99% retention rate. The engineer owns application and product security practices from design through release, setting standards and building controls with engineering teams. The role reduces product risk through secure development, vulnerability management, and customer-facing security support.

What you'll do

• Own and mature the secure software development lifecycle
• conduct threat modeling and design reviews
• operate and tune security scanning
• build secure patterns and policy-as-code controls
• enable developers
• manage vulnerability triage and remediation
• coordinate penetration testing and disclosure
• manage CVE processes and incident response
• maintain product security controls and roadmap
• address customer security findings and requests
• review security for AI-enabled features.

What we're looking for

Skills & competencies

staff application and product security engineer

remote us

cleo

application security

product security

secure development lifecycle

threat modeling

java

vulnerability management

nist csf 2.0

ai security

$160,000–$180,000 per year

Work arrangement

• Weekend coverage required

Benefits & perks

• Healthcare, dental and vision
• flexible PTO
• 401(k) match
• FSA and HSA
• employee assistance program
• paid parental leave
• remote work environment.

Why this role

Requires at least six years in application security, product security, or secure software engineering, including program-building experience; strong object-oriented programming skills are required, with Java preferred.

About the employer

Cleo is hiring for this role. Industry: Computer Systems Design Services. Sector: 54.