Council on Legal Education Opportunity (CLEO)

Security Engineer

• Own and mature Cleo’s secure software development lifecycle, including security requirements, threat modeling, and design reviews
• Run and tune SAST, SCA, secrets detection, container, and IaC scanning
• Build reusable secure patterns, reference implementations, and policy-as-code controls
• Lead developer security enablement through Security Champions, training, remediation guidance, office hours, and self-service capabilities
• Run risk-based triage, remediation, verification, SLAs, escalations, and exceptions for application and product vulnerabilities
• Reproduce externally reported vulnerabilities and validate patches before release
• Own and coordinate penetration-testing engagements and targeted testing
• Run the Vulnerability Disclosure Program and coordinate researcher communications and disclosure
• Coordinate the CVE lifecycle and support product-security incident response
• Own application and product-security controls in Cleo’s NIST CSF 2.0 program, tracking maturity, closing gaps, and producing audit evidence
• Own the security posture of SaaS and customer-hosted products, including secure defaults, authentication, session controls, RBAC, tenant isolation, admin data access, configuration, and hardening guidance
• Own the Product Security Roadmap with Product Management, the CTO, and Architecture
• Prioritize and ship security features including SSO/SAML upgrades, RBAC redesign, endpoint-level access control, and customer-requested controls
• Represent security in RTE Sync and Boundary Review
• Triage customer vulnerability-scan findings and penetration-test reports
• Answer security RFIs and enhancement requests
• Author customer-facing advisories, security release notes, and hardening documentation
• Own threat modeling and security reviews for LLM-enabled features, AI agents, and AI-assisted development workflows
• Build controls for prompt injection, sensitive data exposure, insecure output handling, excessive agency, insecure tool integrations, and AI supply-chain risk
• Apply OWASP Top 10 for LLM Applications and NIST AI Risk Management Framework across product and engineering
• Report to the CISO and partner with Engineering and the Cloud Security team

Staff Application & Product Security Engineer