Clio is the global leader in legal AI technology, empowering legal professionals and law firms of every size to work smarter, faster, and more securely. We are transforming the legal experience for all by bettering the lives of legal professionals while increasing access to justice.

Summary: This role is available to candidates across Canada, excluding Quebec. If you are local to one of our hubs (Burnaby, Calgary, or Toronto) you will be expected to be in office two days per week for our Anchor Days.

Senior Application Security Developer

Clio is looking for a Senior Application Security Developer to join the Vulnerability Management Program within the Application Security Team.

Vulnerability

Management is established as a standing program at Clio, with a clear mission: Vuln0 is the goal, and automation is the path. As a Senior Developer, you will bring solid software development experience combined with deep domain expertise in application security and vulnerability management to architect and build tools that reduce toil, automate vulnerability discovery, drive automated remediation, and partner with product teams across Clio.

In this role, you will help own, operate, and extend the tooling and automation pipeline (including our custom internal security tooling) that powers our vulnerability management lifecycle - covering dependency CVEs, SAST, secret scanning, pentest findings, bug bounty, and infrastructure-as-code. You will work directly with development teams to provide guidance, solve root causes, and remediate vulnerabilities in core codebases. You will collaborate closely with other subteams across Security and Engineering, helping integrate vulnerability sources, refine triage quality, prove reachability, and enable development teams to drive open vulnerabilities to zero past SLA.

Program Philosophy & Mission

Vuln0 is the goal: Vuln0 means zero vulnerabilities open past SLA

Automation is the path: We cannot scale the team by adding humans to manually triage and patch. We reach Vuln0 generating fixes automatically, and reserving human effort for complex edge cases.

The “Vuln-pocalypse” is here and we need people that can apply tooling to ride this wave.

Be excited about solving hard problems the right way

Risk-based prioritization: Risk and exploitability determine sequencing so development teams focus on what is reachable and actionable

Enforceable SLAs & clear ownership: VM owns the process, tooling, systems, and automation; development teams own resolving their own vulnerabilities with our guidance and assistance A Day in the Life

Developing automation in internal tooling to ingest new vulnerability sources, normalize finding data, and generate automated fix PRs for all vulnerabilities

Using state-of-the-art AI tooling (Claude Mythos, Daybreak)

Partnering with development teams to advise on security best practices, provide guidance on complex vulnerability remediations, or write root-cause fixes directly in core codebases

Integrating AI processing tools to streamline triage, assess reachability, and automate all aspects of the SDLC

Building data aggregation services and reporting dashboards to measure program health, SLA compliance, and security scorecards across product teams

Participating in incident response when a security event occurs and contributing to a strong culture of continuous improvement

What You'll Do

Automation & Program Tooling





Develop and implement automation tooling within our internal tooling to eliminate toil across the vulnerability pipeline — from ingestion to automated remediation

Integrate multiple finding sources into a single unified pipeline, including dependency CVEs, SAST & secret scanning, penetration testing, vulnerability disclosures/bug bounty, and cloud posture/IaC findings

Expand AI-driven processing capabilities for triage, bug description formalization, severity assignment, and fix confidence grading

Build data pipeline services for the Security Scorecard, tracking team-by-team remediation performance, SLA compliance, and dependency hygiene

Remediation & Developer Support

Provide detailed technical guidance and support to development teams during vulnerability remediation

Remediate complex or high-risk vulnerabilities directly in core codebases when automation cannot close the gap

Perform root-cause analysis across finding patterns to help eliminate entire vulnerability classes rather than just individual instances

Assist with onboarding acquired and newly created entities and products into the central pipeline and vulnerability program

Culture & Incident Response

Build strong partnerships with product engineering teams to drive vulnerabilities outside SLA to zero

Grow security awareness and knowledge amongst the product organization

Assist incident response when a security event occurs

Elevate and educate our security culture within Clio, exemplifying our values of “Velocity Wins” and “Get Better Every Day”

What You Bring

Senior-level experience in software development with languages such as Ruby, Python, JavaScript, or equivalent modern technologies

Demonstrated security expertise in vulnerability management, web application security, secure software development, cloud security, architecture review, or threat modeling

Proven ability to develop tools and automation that eliminate operational toil and streamline workflows

Clear communication skills to advise developers, explain complex security risks clearly, and advocate for security best practices

Proven track record of serving as a technical security expert and building creative, scalable security solutions in a fast-paced continuous integration environment deploying 50+ times a day A keen interest in improving your craft using AI

Bonus Points

Prior experience building automation on vulnerability scanners, SAST tools, or central vulnerability management platforms (e.g., Overlord)

Familiarity with container security, Infrastructure-as-Code (IaC) scanning, and cloud security posture tools

Experience with AI/LLM integration for automated triage and security workflows

What you will find here:

Compensation

Compensation is one of the main components of Clio’s Total Rewards Program. We have developed a series of programs and processes to ensure we are creating fair and competitive pay practices that form the foundation of our human and high-performing culture. Some highlights of our Total Rewards program include:

Competitive, equitable salary with top-tier health benefits, dental, and vision insurance

Hybrid work environment,



with expectation for local Clions (Vancouver, Calgary, Toronto, Dublin, London, New York City and Sydney) to be in office min. twice per week.

Flexible time off policy, with an encouraged 20 days off per year.

$2000 annual counseling benefit

RRSP matching and RESP contribution

Clioversary recognition program with special acknowledgement at 3, 5, 7, and 10 years The expected salary range for this role is $157,300 to $212,800 CAD. Initial placement within the range is informed by geographic region, experience, and skillset, with room to progress as impact and tenure grow. Final offer amounts will vary based on candidate profile.

Diversity, Inclusion, Belonging and Equity (DIBE) & Accessibility

Our team shows up as their authentic selves, and are united by our mission. We are dedicated to diversity, equity and inclusion. We pride ourselves in building and fostering an environment where our teams feel included, valued, and enabled to do the best work of their careers, wherever they choose to log in from.

We believe that different perspectives, skills, backgrounds, and experiences result in higher-performing teams and better innovation. We are committed to equal employment and we encourage candidates from all backgrounds to apply. Clio provides accessibility accommodations during the recruitment process.

Should you require any accommodation, please let us know and we will work with you to meet your needs.

About Clio

Clio is on a mission to transform the legal experience for all. Clio is the global leader in legal AI, building the platform that powers the future of legal work. With the scale, data, and ambition to redefine how the legal industry operates, we are advancing a comprehensive strategy that spans the full lifecycle of legal work—from knowledge and insight to execution and outcomes.

At the center of this vision is the Intelligent Legal Work Platform, the legal industry’s first System of Action. By combining Clio’s core product suite with Clio Work and AI-native capabilities, the platform turns information into insight and insight into action. As we expand into the enterprise, Clio for Enterprise extends this foundation to support the complexity, scale, and operational rigor of global organizations through solutions like Clio Operate and Vincent by Clio.

Backed by industry-leading data and intelligence, Clio is building the infrastructure that enables legal teams to operate with greater speed, confidence, and impact. Clio’s leadership and momentum have been recognized globally. In 2022, we achieved Centaur status, a milestone reached by fewer than 200 private SaaS companies worldwide.

We are a proud honoree of the Forbes Cloud 100 and Fortune’s Future 50, have been named Innovator of the Year, and are a Platinum Club member of Canada’s Best Managed Companies. We are consistently recognized as one of Canada’s Top 100 Employers and a Top Employer for Young People, with our international offices also earning placements on Outstanding Place to Work’s Best Workplaces lists. Headquartered in Vancouver, Canada, Clio has grown to more than 2,000 employees across offices in Toronto, Calgary, Dublin, Manchester, Sydney, Barcelona, and Bogotá—bringing together diverse perspectives to solve one of the world’s most complex and impactful professional challenges.

Join Clio and help define the future of legal work through AI. Learn more at clio.com/careers.

📌 Senior Application Security Developer (Winnipeg)
🏢 Themis Solutions
📍 Winnipeg