Clio is the global leader in legal AI technology, empowering legal professionals and law firms of every size to work smarter, faster, and more securely. We are transforming the legal experience for all by bettering the lives of legal professionals while increasing access to justice.
Summary: This role is available to candidates across Canada, excluding Quebec. If you are local to one of our hubs (Burnaby, Calgary, or Toronto) you will be expected to be in office two days per week for our Anchor Days.
Senior Application Security Developer
Clio is looking for a Senior Application Security Developer to join the Vulnerability Management Program within the Application Security Team. Vulnerability Management is established as a standing program at Clio, with a clear mission: Vuln0 is the goal, and automation is the path. As a Senior Developer, you will bring solid software development experience combined with deep domain expertise in application security and vulnerability management to architect and build tools that reduce toil, automate vulnerability discovery, drive automated remediation, and partner with product teams across Clio.
In this role, you will help own, operate, and extend the tooling and automation pipeline (including our custom internal security tooling) that powers our vulnerability management lifecycle
- covering dependency CVEs, SAST, secret scanning, pentest findings, bug bounty, and infrastructure-as-code. You will work directly with development teams to provide guidance, solve root causes, and remediate vulnerabilities in core codebases. You will collaborate closely with other subteams across Security and Engineering, helping integrate vulnerability sources, refine triage quality, prove reachability,



and enable development teams to drive open vulnerabilities to zero past SLA.
Program Philosophy & Mission
Vuln0 is the goal: Vuln0 means zero vulnerabilities open past SLAAutomation is the path: We cannot scale the team by adding humans to manually triage and patch. We reach Vuln0 generating fixes automatically, and reserving human effort for complex edge cases.
The “Vuln-pocalypse” is here and we need people that can apply tooling to ride this wave.
Be excited about solving hard problems the right wayRisk-based prioritization: Risk and exploitability determine sequencing so development teams focus on what is reachable and actionableEnforceable SLAs & clear ownership: VM owns the process, tooling, systems, and automation;
development teams own resolving their own vulnerabilities with our guidance and assistanceA Day in the Life
Developing automation in internal tooling to ingest recent vulnerability sources, normalize finding data, and generate automated fix PRs for all vulnerabilitiesUsing state-of-the-art AI tooling (Claude Mythos, Daybreak)Partnering with development teams to advise on security best practices, provide guidance on complex vulnerability remediations, or write root-cause fixes directly in core codebasesIntegrating AI processing tools to streamline triage, assess reachability, and automate all aspects of the SDLCBuilding data aggregation services and reporting dashboards to measure program health,



SLA compliance, and security scorecards across product teamsParticipating in incident response when a security event occurs and contributing to a strong culture of continuous improvementWhat You'll Do
Automation & Program Tooling
Develop and implement automation tooling within our internal tooling to eliminate toil across the vulnerability pipeline — from ingestion to automated remediationIntegrate multiple finding sources into a single unified pipeline, including dependency CVEs, SAST & secret scanning, penetration testing, vulnerability disclosures/bug bounty, and cloud posture/IaC findingsExpand AI-driven processing capabilities for triage, bug description formalization, severity assignment, and fix confidence gradingBuild data pipeline services for the Security Scorecard, tracking team-by-team remediation performance, SLA compliance, and dependency hygieneRemediation & Developer Support
Provide detailed technical guidance and support to development teams during vulnerability remediationRemediate complex or high-risk vulnerabilities directly in core codebases when automation cannot close the gapPerform root-cause analysis across finding patterns to help eliminate entire vulnerability classes rather than just individual instancesAssist with onboarding acquired and newly created entities and products into the central pipeline and vulnerability programCulture & Incident Response
Build strong partnerships with product engineering teams to drive vulnerabilities outside SLA to zeroGrow security awareness and knowledge amongst the product organizationAssist incident response when a security event occursElevate and educate our security culture within Clio, exe

📌 Senior Application Security Developer (Winnipeg)
🏢 Themis Solutions
📍 Winnipeg