The ideal candidate possesses deep expertise in penetration testing, threat modeling, application security, and secure development practices, with the ability to translate complex security findings into actionable remediation guidance. This role requires a security professional who can think like an attacker, validate security controls through manual and automated testing, and influence product teams to build resilient, secure solutions by design.
In addition to conducting security assessments, the Cybersecurity Engineer will help mature Clario’s DevSecOps capabilities by integrating security validation, testing, and governance into development pipelines and engineering workflows. Success in this role requires strong technical skills, effective communication, and the ability to work collaboratively across the organization to drive measurable security improvements.
Clario, part of Thermo Fisher Scientific, is seeking a highly skilled Cybersecurity Engineer to strengthen our Product Security and DevSecOps capabilities through a combination of penetration testing, threat modeling, secure design reviews, and security automation. In this role, you will conduct comprehensive security assessments across web applications, APIs, cloud environments, and supporting infrastructure to identify vulnerabilities and validate security controls. You will partner closely with Product, Engineering, Architecture, and DevOps teams to perform threat modeling exercises, review security architectures, and embed security-by-design principles throughout the Software Development Lifecycle (SDLC). The ideal candidate will have strong expertise in application security, threat modeling frameworks such as STRIDE or PASTA, secure development practices, and DevSecOps methodologies, with hands-on experience integrating security testing into CI/CD pipelines. This role also involves developing security automation, supporting vulnerability management and remediation efforts, mentoring engineering teams, contributing to security standards and governance initiatives, and driving continuous improvement across Clario's Product Security program. Success in this position requires the ability to think like an attacker, communicate risk effectively to technical and business stakeholders, and leverage modern security practices, cloud security knowledge, and automation technologies to build scalable, resilient, and secure products.
What We Offer
Competitive compensation
Provident fund and medical insurance
Engaging employee programs and local events
Modern office spaces and remote work flexibility
What You’ll Be Doing
Conduct comprehensive penetration testing of web applications, APIs, cloud environments, and supporting infrastructure to identify security vulnerabilities and validate security controls.
Lead threat modeling exercises for new and existing products, partnering with engineering and architecture teams to identify risks, attack paths, and appropriate mitigations early in the SDLC.
Perform secure design and architecture reviews to ensure products are built with security-by-design principles and aligned with industry standards and best practices.
Evaluate application, cloud, and infrastructure security controls and provide actionable recommendations to reduce risk and improve overall security posture.
Willingness to work in European Shift (1pm to 10pm)
Work closely with development teams to prioritize, track, and remediate security findings while promoting secure coding practices.
Integrate security testing and validation into CI/CD pipelines, enabling automated security checks and continuous risk identification throughout the development lifecycle.
Develop and maintain security tooling, scripts, and automation capabilities that improve the efficiency and effectiveness of security assessments.
Collaborate with Product, Engineering, DevOps, and Architecture teams to embed security requirements into product planning, design, development, and deployment processes.
Support vulnerability management activities, including validation, risk assessment, remediation guidance, and verification of fixes.
Contribute to the development and maintenance of security standards, secure development guidelines, and product security processes.
Stay current on emerging threats, attack techniques, vulnerabilities, and security technologies, applying that knowledge to improve Clario's security capabilities.
Provide technical guidance and mentorship to engineering teams on secure design, threat mitigation, and security best practices.
Assist with security audits, compliance initiatives, and evidence collection activities related to product and application security controls.
Drive continuous improvement of Clario's Product Security and DevSecOps programs through innovation, automation, and the adoption of industry-leading practices.Time Allocation (Typical)
30–55% Product Security Engineering (Threat Modeling, Secure Design Reviews, Security Architecture Assessments, Developer Enablement)
30–55% Penetration Testing and Security Validation Activities
10–15% Security Automation, DevSecOps Integration, Governance, and Process Improvement
What We Look For
Bachelor's degree in Computer Science, Cybersecurity, Information Security, Software Engineering, or a related technical discipline, or equivalent practical experience.
5+ years of experience in Cybersecurity, Application Security, Product Security, Security Engineering, or a related field.
Demonstrated experience performing manual and automated penetration testing of web applications, APIs, cloud environments, and supporting infrastructure.
Strong experience conducting threat modeling and security architecture reviews using established methodologies such as STRIDE, PASTA, ATT&CK, or equivalent frameworks.
Solid understanding of secure software development practices, common attack techniques, and security vulnerabilities, including the OWASP Top 10 and API Security Top 10.
Experience identifying, validating, and communicating security risks to technical and non-technical stakeholders.
Proficiency in one or more programming or scripting languages such as Python, Java, JavaScript, C#, PowerShell, Go, or similar languages.
Experience working within Agile development environments and integrating security practices into the SDLC.
Strong understanding of DevSecOps principles and experience integrating security tools into CI/CD pipelines.
Excellent analytical, problem-solving, communication, and collaboration skills.
Ability to independently drive security initiatives while partnering effectively with Engineering, Product, Architecture, and Operations teams.
Experience with cloud security assessments and securing environments in AWS, Azure, or Google Cloud Platform.
Experience with modern application architectures including microservices, APIs, containers, Kubernetes, and serverless technologies.
Familiarity with Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), Container Security, and Infrastructure-as-Code security tools.
Experience developing security automation, custom security tooling, or pipeline integrations to improve security coverage and efficiency.
Knowledge of secure architecture patterns, identity and access management, cryptography, and zero-trust security concepts.
Experience supporting regulatory, compliance, or audit requirements in highly regulated industries such as healthcare, life sciences, or financial services.
Security certifications such as:
OSCP (Offensive Security Certified Professional)
OSWE (Offensive Security Web Expert)
GWAPT (GIAC Web Application Penetration Tester)
GWEB (GIAC Web Application Defender)
CISSP (Certified Information Systems Security Professional)
CCSP (Certified Cloud Security Professional)
Azure, AWS, or GCP Security Certifications
A security-minded engineer who can think like an attacker while partnering with developers to build secure solutions.
Passionate about identifying and mitigating security risks before they become vulnerabilities.
Comfortable balancing hands-on technical work with strategic security guidance and influence.
Curious, self-motivated, and committed to continuously learning emerging technologies, attack techniques, and industry best practices.
An advocate for Security-by-Design who can drive security improvements without slowing product innovation.
Skilled at translating complex security concepts into practical recommendations that enable business and engineering outcomes.
Focused on automation, scalability, and continuous improvement to enhance both security effectiveness and developer experience.
Building or operating Product Security programs.
Leading enterprise-wide threat modeling initiatives.
Conducting red team or adversarial security assessments.
Creating security standards, secure coding guidance, or developer training programs.
Leveraging AI-assisted security analysis, remediation workflows, or security engineering automation.
At Clario, a part of Thermo Fisher Scientific, our purpose is to transform lives by unlocking better evidence. Whether you're advancing clinical science, building innovative technology, or supporting our global teams, your work helps bring life-changing therapies to patients faster.
The Department Head has the discretion to hire personnel with a combination of experience and education, which may vary from the above listed qualifications.
EEO Statement
Clario is an equal opportunity employer. Clario evaluates qualified applicants without regard to race, color, religion, gender, national origin, age, sexual orientation, gender identity or expression, protected veteran status, disability/handicap status, or any other legally protected characteristic.
Skills Required
- Bachelor's degree in Computer Science, Cybersecurity, or equivalent experience
- 5+ years experience in Cybersecurity, Application Security, Product Security, or Security Engineering
- Manual and automated penetration testing of web applications, APIs, cloud environments, and infrastructure
- Threat modeling and security architecture reviews using STRIDE, PASTA, ATT&CK or equivalent
- Strong knowledge of secure development practices, OWASP Top 10 and API Security Top 10
- Proficiency in one or more scripting/programming languages (Python, Java, JavaScript, C#, PowerShell, Go)
- Experience integrating security tools into CI/CD pipelines and DevSecOps workflows
- Cloud security experience in AWS, Azure, or Google Cloud Platform
- Experience with modern architectures: microservices, APIs, containers, Kubernetes, serverless
- Familiarity with SAST, DAST, SCA, container security, and IaC security tools
- Experience developing security automation, custom tooling, or pipeline integrations
- Ability to communicate security risks to technical and non-technical stakeholders and mentor teams
- Experience supporting regulatory, compliance, or audit requirements in regulated industries (healthcare, life sciences, financial)
- Security certifications such as OSCP, OSWE, GWAPT, CISSP, CCSP, or cloud security certs
- Experience building/operating Product Security programs, leading enterprise threat modeling, or red team assessments
- Willingness to work European shift (1pm to 10pm)
Clario Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Clario and has not been reviewed or approved by Clario.
-
Leave & Time Off Breadth — Time off is described as generous, including flexible PTO for some roles and up to 26–31 PTO days for eligible staff. The calendar includes 15 paid company holidays and a Winter Break.
-
Healthcare Strength — Healthcare offerings include multiple medical plan options via Highmark with coordinated care navigation, plus dental and vision through established carriers. Employer HSA contributions and mental-health support broaden the package.
-
Inclusive Benefits Coverage — Coverage highlights include domestic-partner eligibility, transgender-inclusive care, and HIV prevention/treatment. These inclusive elements are presented alongside broader inclusion commitments.
Clario Insights
What We Do
-- Clario has been named a Top Workplace by Energage for the 2022 Top Workplaces USA national awards. -- Clario generates the richest clinical evidence by fusing our deep scientific expertise and global scale into the broadest endpoint technology platform. By doing this, we empower our partners to transform lives. With almost 50 years of experience, 19,000 clinical trials, and 870 regulatory approvals, Clario has mastered the ability to generate rich evidence across a Trial Anywhere™ portfolio: decentralized (DCT), hybrid and site-based clinical trials. With 30 facilities in nine countries across North America, Europe, and Asia Pacific, Clario delivers the power of certainty. Partners ————— Clario brings the best of ERT and Bioclinica together to work alongside our partners to solve some of their biggest questions on topics such as: - eCOA vs. paper - Decentralized Clinical Trial (DCT) - Rescue a clinical trial - Broad endpoint technology: cardiac safety, imaging, respiratory And many more. People ———— We are so honoured to be named a 2022 Top Workplace by Energage. One of our leading values at Clario is People First Always. We help individuals build meaningful careers at Clario as they serve to help transform patients lives. Join us on this journey and check out our careers page: https://clario.com/careers/
