Staff Application & Product Security Engineer

Vaga não está no LinkedIn

🕒 Outubro 2

🇺🇸 Estados Unidos – Remoto (EUA)

💵 $160.000 - $180.000 / ano

⏰ Tempo Integral

🔴 Especialista

👮‍♂️ Cibersegurança / Engenheiro de Segurança

👻 Score fantasma 10%

O que significa: a chance de ninguém estar realmente contratando para esta vaga.Como ler: 60% ou mais significa que achamos que é uma vaga fantasma. Pontuações mais baixas preocupam menos.Como pontuamos: tempo em aberto, republicações, vagas abertas vs tamanho do time, rapidez para fechar vagas, e se o salário está divulgado.Observação: é uma estimativa de dados públicos, não um julgamento da empresa. Vagas reais podem ter pontuação alta, então use como uma dica, não como um fato.

Candidatar-se

Encontrar Vagas Remotas Similares

Council on Legal Education Opportunity (CLEO)

SiteLinkedInTodas as Vagas

1 - 10 funcionários

Fundada em 1968

📚 Educação

🤝 Sem Fins Lucrativos

🌍 Impacto Social

Education • Non-profit • Social Impact

O Council on Legal Education Opportunity (CLEO) é uma organização nacional sem fins lucrativos estabelecida em 1968 com a missão de aumentar o acesso à educação jurídica para comunidades estudantis sub-representadas. Como uma entidade 501(c)(3), o CLEO está focado em preparar estudantes para ingressar com sucesso na faculdade de Direito e alcançar êxito na profissão jurídica através de vários programas de apoio. Estes incluem programas de pipeline pré-direito, preparação para o LSAT, apoio acadêmico e oportunidades de networking através da vasta rede de ex-alunos. O objetivo primordial do CLEO é promover diversidade, equidade e inclusão no campo jurídico, promovendo assim justiça social e igualdade na profissão.

Descrição

• Own and mature Cleo’s secure software development lifecycle, including security requirements, threat modeling, and design reviews • Run and tune SAST, SCA, secrets detection, container, and IaC scanning • Build reusable secure patterns, reference implementations, and policy-as-code controls • Lead developer security enablement through Security Champions, training, remediation guidance, office hours, and self-service capabilities • Run risk-based triage, remediation, verification, SLAs, escalations, and exceptions for application and product vulnerabilities • Reproduce externally reported vulnerabilities and validate patches before release • Own and coordinate penetration-testing engagements and targeted testing • Run the Vulnerability Disclosure Program and coordinate researcher communications and disclosure • Coordinate the CVE lifecycle and support product-security incident response • Own application and product-security controls in Cleo’s NIST CSF 2.0 program, tracking maturity, closing gaps, and producing audit evidence • Own the security posture of SaaS and customer-hosted products, including secure defaults, authentication, session controls, RBAC, tenant isolation, admin data access, configuration, and hardening guidance • Own the Product Security Roadmap with Product Management, the CTO, and Architecture • Prioritize and ship security features including SSO/SAML upgrades, RBAC redesign, endpoint-level access control, and customer-requested controls • Represent security in RTE Sync and Boundary Review • Triage customer vulnerability-scan findings and penetration-test reports • Answer security RFIs and enhancement requests • Author customer-facing advisories, security release notes, and hardening documentation • Own threat modeling and security reviews for LLM-enabled features, AI agents, and AI-assisted development workflows • Build controls for prompt injection, sensitive data exposure, insecure output handling, excessive agency, insecure tool integrations, and AI supply-chain risk • Apply OWASP Top 10 for LLM Applications and NIST AI Risk Management Framework across product and engineering • Report to the CISO and partner with Engineering and the Cloud Security team

🎯 Requisitos

• 6+ years in application security, product security, or secure software engineering, including experience building or maturing an AppSec program across multiple engineering teams • Strong proficiency in an object-oriented programming language; Java preferred • Ability to read, debug, and write production-quality code • Comfort working across TypeScript, Python, or Go • Deep knowledge of authentication, authorization, API security, business-logic flaws, and modern service architectures • Hands-on experience integrating and tuning SAST, SCA, and secrets scanning in GitHub and CI/CD pipelines • Hands-on exploit reproduction and patch validation against running Java web applications • Coordinated disclosure experience with external security researchers and customers, including driving a CVE to publication • Product security experience on shipped software with an installed base • Experience running threat modeling, design reviews, and manual security testing • Ability to work directly with developers through remediation • Ability to translate technical risk into engineering guidance for developers and executives • Ability to hold release-gating decisions with Engineering leadership • Nice-to-have: securing LLM applications, AI agents, or AI-assisted development tools • Nice-to-have: SBOM, CycloneDX/SPDX, VEX, artifact signing, and SLSA • Nice-to-have: AWS, Kubernetes/EKS, Terraform, Jenkins • Nice-to-have: Snyk, GitHub Advanced Security, Semgrep, Burp Suite • Nice-to-have: NIST CSF 2.0, OWASP SAMM/ASVS, NIST SSDF, SOC 2 or ISO 27001 audits • Nice-to-have: CSSLP, OSWE, GWAPT, AWS Security, or comparable certifications • Nice-to-have: SaaS and customer-hosted deployment models; SSO/SAML, RBAC design, multi-tenant isolation; MFT/EDI or other B2B integration products

🏖️ Benefícios

• Bonus Opportunity • Great Healthcare + Dental + Vision • Flexible PTO • Culture of support, encouraging Life-Work balance • 401k match • FSA and HSA options • Employee Assistance Program • Paid Parental Leave • Remote work environment • Accelerated title and salary growth potential • Fun and energetic work environment

📊 Verifique sua pontuação de currículo para esta vaga

Melhore suas chances de conseguir uma entrevista verificando sua pontuação de currículo antes de se candidatar.

Enviar Currículo