Staff Application & Product Security Engineer

Emploi pas sur LinkedIn

🕒 il y a 14 jours

🇺🇸 États-Unis – Télétravail

💵 $160 000 - $180 000 / an

⏰ Temps Plein

🔴 Expert

👮‍♂️ Cybersécurité / Ingénieur Sécurité

👻 Score fantôme 8%

Ce que ça veut dire : la probabilité que cette offre reste ouverte sans recrutement actif.Comment le lire : 60 % ou plus, on pense que c'est une offre fantôme. Un score plus bas est moins inquiétant.Comment on la calcule : ancienneté, republications, postes ouverts vs taille de l'équipe, rapidité de clôture, et si le salaire est indiqué.À noter : une estimation à partir de données publiques, pas un jugement sur l'entreprise. De vraies offres peuvent avoir un score élevé, alors prenez-le comme un indice, pas comme un fait.

Postuler Maintenant

Trouver des Emplois à Distance Similaires

Configurer une alerte email pour les nouveaux emplois

📊 Vérifiez votre score de CV pour ce poste

Améliorez vos chances d'obtenir un entretien en vérifiant votre score de CV avant de postuler.

Télécharger le CV

Council on Legal Education Opportunity (CLEO)

Site WebLinkedInTous les Emplois

1 - 10 employés

Fondée en 1968

📚 Éducation

🤝 À but non lucratif

🌍 Impact social

Education • Non-profit • Social Impact

Le Council on Legal Education Opportunity (CLEO) est une organisation nationale à but non lucratif fondée en 1968 avec pour mission d'accroître l'accès à l'éducation juridique pour les communautés étudiantes sous-représentées. En tant qu'organisation 501(c)(3), CLEO se consacre à préparer les étudiants à entrer avec succès en faculté de droit et à réussir dans la profession juridique grâce à divers programmes de soutien. Ceux-ci comprennent des programmes de préparation pré-juridique, la préparation au LSAT, un soutien académique et des opportunités de réseautage via son vaste réseau d'anciens élèves. L'objectif général de CLEO est de favoriser la diversité, l'équité et l'inclusion dans le domaine juridique, promouvant ainsi la justice sociale et l'égalité dans la profession.

Description

• Own and mature Cleo’s secure software development lifecycle, including security requirements, threat modeling, and design reviews • Run and tune SAST, SCA, secrets detection, container, and IaC scanning • Build reusable secure patterns, reference implementations, and policy-as-code controls • Lead developer security enablement through Security Champions, training, remediation guidance, office hours, and self-service capabilities • Run risk-based triage, remediation, verification, SLAs, escalations, and exceptions for application and product vulnerabilities • Reproduce externally reported vulnerabilities and validate patches before release • Own and coordinate penetration-testing engagements and targeted testing • Run the Vulnerability Disclosure Program and coordinate researcher communications and disclosure • Coordinate the CVE lifecycle and support product-security incident response • Own application and product-security controls in Cleo’s NIST CSF 2.0 program, tracking maturity, closing gaps, and producing audit evidence • Own the security posture of SaaS and customer-hosted products, including secure defaults, authentication, session controls, RBAC, tenant isolation, admin data access, configuration, and hardening guidance • Own the Product Security Roadmap with Product Management, the CTO, and Architecture • Prioritize and ship security features including SSO/SAML upgrades, RBAC redesign, endpoint-level access control, and customer-requested controls • Represent security in RTE Sync and Boundary Review • Triage customer vulnerability-scan findings and penetration-test reports • Answer security RFIs and enhancement requests • Author customer-facing advisories, security release notes, and hardening documentation • Own threat modeling and security reviews for LLM-enabled features, AI agents, and AI-assisted development workflows • Build controls for prompt injection, sensitive data exposure, insecure output handling, excessive agency, insecure tool integrations, and AI supply-chain risk • Apply OWASP Top 10 for LLM Applications and NIST AI Risk Management Framework across product and engineering • Report to the CISO and partner with Engineering and the Cloud Security team

🎯 Exigences

• 6+ years in application security, product security, or secure software engineering, including experience building or maturing an AppSec program across multiple engineering teams • Strong proficiency in an object-oriented programming language; Java preferred • Ability to read, debug, and write production-quality code • Comfort working across TypeScript, Python, or Go • Deep knowledge of authentication, authorization, API security, business-logic flaws, and modern service architectures • Hands-on experience integrating and tuning SAST, SCA, and secrets scanning in GitHub and CI/CD pipelines • Hands-on exploit reproduction and patch validation against running Java web applications • Coordinated disclosure experience with external security researchers and customers, including driving a CVE to publication • Product security experience on shipped software with an installed base • Experience running threat modeling, design reviews, and manual security testing • Ability to work directly with developers through remediation • Ability to translate technical risk into engineering guidance for developers and executives • Ability to hold release-gating decisions with Engineering leadership • Nice-to-have: securing LLM applications, AI agents, or AI-assisted development tools • Nice-to-have: SBOM, CycloneDX/SPDX, VEX, artifact signing, and SLSA • Nice-to-have: AWS, Kubernetes/EKS, Terraform, Jenkins • Nice-to-have: Snyk, GitHub Advanced Security, Semgrep, Burp Suite • Nice-to-have: NIST CSF 2.0, OWASP SAMM/ASVS, NIST SSDF, SOC 2 or ISO 27001 audits • Nice-to-have: CSSLP, OSWE, GWAPT, AWS Security, or comparable certifications • Nice-to-have: SaaS and customer-hosted deployment models; SSO/SAML, RBAC design, multi-tenant isolation; MFT/EDI or other B2B integration products

🏖️ Avantages

• Bonus Opportunity • Great Healthcare + Dental + Vision • Flexible PTO • Culture of support, encouraging Life-Work balance • 401k match • FSA and HSA options • Employee Assistance Program • Paid Parental Leave • Remote work environment • Accelerated title and salary growth potential • Fun and energetic work environment