Senior Product Security Engineer (USA Only, 100% Remote)

Close, USA - Remote

The role

Close is a CRM built around the communication tools sales teams use every day: email, calling, SMS, workflows, reporting, and AI. Underneath that product is a broad technical surface — Python services and a large application backend, a TypeScript and React frontend, public APIs, Docker and Kubernetes, AWS infrastructure, and integrations with providers that handle sensitive customer data.

Security work happens across it all today, but the ownership is spread across Engineering, Infrastructure, and Security & Trust. We’re hiring our first dedicated Product Security Engineer to make that work systematic. You’ll report to the Backend Platform team manager within EPD (Engineering, Product, and Design), while working across the entire product and infrastructure surface. You’ll find vulnerabilities, determine which findings matter most, and drive them through remediation.

Often you’ll fix the problem yourself. Other times you’ll give the owning team a clear reproduction, a practical path forward, and enough context to prioritize correctly.

You’ll analyze code, build proof-of-concepts, test running applications, tune or replace noisy tools, and automate the repetitive parts of vulnerability management. This is not a role where you forward scanner alerts and call the queue managed. Product and application security will be your responsibility. You’ll partner closely with our Infrastructure team on cloud security, access, and secrets, and with our Security & Trust Lead on GRC Engineering https://grc.engineering/, compliance (SOC 2) goals, audits, and corporate security.

The role

Often you’ll fix the problem yourself. Other times you’ll give the owning team a clear reproduction, a practical path forward, and enough context to prioritize correctly.

What you will do

The work spans hands-on application security, security automation, vulnerability management, and infrastructure partnership. Depending on where you find the greatest risk and leverage, projects could include:

Build a recurring product security review program. Threat model new features, audit high-risk areas, review code, and build safe proof-of-concepts in isolated development environments. Work across our backend, frontend, APIs, and customer-facing integrations.
Improve application security testing. Combine static analysis, dependency and secrets scanning, dynamic testing in development, and carefully scoped production testing. Use existing tools where they fit and build focused automation where they don’t.
Own vulnerability intake and remediation. Triage findings from HackerOne, scanners, penetration tests, audits, customers, and internal research. Reproduce issues, assess exploitability and impact, track remediation, and verify fixes. Serve as technical lead for our bug bounty program while contract and budget ownership remain elsewhere.
Turn security alerts into useful engineering work. Verify scanner coverage and automate ingestion, deduplication, enrichment, prioritization, and routing—so teams spend less time interpreting alerts and more time fixing important issues.
Make dependency remediation safer and less manual. Improve scanning across our Python and TypeScript codebases, then build workflows to assess upgrades, stage pull requests, run checks, and route work without exposing credentials to untrusted packages or build steps.
Make secrets routinely rotatable. Partner with service owners and Infrastructure to inventory application secrets, add graceful rotation paths, document provider-specific runbooks, and automate rotation where the provider and risk justify it. Expand our use of Vault-backed dynamic credentials and reduce the number of rotations that require a coordinated fire drill.
Strengthen AWS security with Infrastructure. Evaluate and improve automated detection of risky configuration across identity, networking, compute, storage, containers, and registries. Turn findings into secure defaults, just-in-time access patterns, infrastructure guardrails, and actionable remediation—not build a second Infrastructure team.
Support audits and raising the security floor. Partner with Security & Trust on external assessments, provide technical context, and ensure findings are fixed rather than rediscovered. Along the way, create documentation, paved roads, and lightweight training that helps engineers make safer choices without waiting for a security review.
Take a key technical role in security incident response. Partner with Engineering and Infrastructure to coordinate investigation, containment, and remediation. Contribute to root-cause analysis and follow-up improvements, translating lessons learned into stronger controls and reduced recurrence.

Tech you’ll touch: Python, TypeScript, React, Flask, FastAPI, GraphQL, Docker, Kubernetes, AWS, Vault, GitHub Actions, MongoDB, PostgreSQL, Redis, Kafka, Elasticsearch and the security tooling you help us choose.

What you need

An application security engineer who writes code. You can move from reading an unfamiliar code path, to reproducing an exploit, to proposing or shipping a production-quality fix. Strong Python or TypeScript experience would be especially useful; fluency across both backend and frontend systems is even better.
Skilled at finding vulnerabilities conventional scanners may miss. You use modern AI-assisted review pipelines, guided by expert judgment, to uncover subtle flaws in web apps and APIs—from authentication, authorization, and tenant isolation to injection, SSRF, unsafe data flows, and business logic. You can threat-model designs, white-box review code, and test running systems.
Offensive-minded and operationally responsible. You know how to test like an attacker without being careless with customer data or production systems. You can turn a finding into a safe reproduction, assess exploitability and business impact, and retest the eventual fix.
An automation builder. You have worked with some mix of SAST, DAST, software composition analysis, container scanning, secrets scanning, or cloud posture tooling. More importantly, you know how to tune tools, connect them to engineering workflows, and remove noise.
AI-native and accountable. You use coding agents and LLMs to accelerate investigation, code review, and repetitive engineering work, but you verify their output. You think carefully about what happens when agents clone untrusted code, install dependencies, or receive access to credentials.
Able to separate severity from priority. A score is an input, not a foregone conclusion. You consider reachability, existing controls, customer impact, and attack chains, then explain the risk in language that is legible to an engineer or business owner.
Comfortable working across the business. You’ll collaborate with product engineers, Site Reliability Engineers, Security & Trust Lead, auditors, and external researchers without confusing partnership for pass-off ownership. You will follow findings to closure even when another team is responsible for the fix.
Self-directed in a remote environment. You can take an ambiguous surface (say, secret rotation or dependency remediation) and learn how it works across multiple systems then turn it into a practical plan with measurable progress.

You do not need to arrive as the deepest expert in every part of this scope. You do need to be able to investigate an unfamiliar system, determine what matters, and bring the right people with you.

Senior Product Security Engineer (USA Only, 100% Remote)

The role

Senior Product Security Engineer (USA Only, 100% Remote)

The role

What you will do

What you need

Our stack

Learn more

Our hiring process

Pay and benefits

About Close

About Us

Our values

Similar jobs at other companies

Senior Product Security Engineer - Remote working within Germany

Product Engineer, Cyber

Senior Software Engineer - Product Security

Full Stack Software Engineer, Cybersecurity Products

Senior Product Security Engineer

Staff Product Security Engineer (Security)

Close