This role is fully remote and only open to applicants based in the United States.
Most security jobs ask you to watch a queue of scanner alerts. This one asks you to build the whole product security function from scratch at a profitable, fully remote software company.
About Close
Close makes a CRM built around the tools sales teams use every day: email, calling, SMS, workflows and reporting, with AI now built into each part. The company has been bootstrapped and profitable since 2013 and has a 120 person team that works 100% remotely.
About the Role
You will be Close's first dedicated Product Security Engineer, reporting to the Backend Platform team manager and working across the whole product and infrastructure. You will:
- Run a recurring product security review program: threat models, code audits and safe proof of concepts
- Improve security testing with static analysis, dependency and secrets scanning and dynamic testing
- Own vulnerability intake from HackerOne, scanners, pen tests and customers, and drive fixes to closure
- Make dependency updates and secret rotation safer and more automated
- Work with the Infrastructure team on AWS security and act as a key technical lead in incident response
About You
- An application security engineer who writes code, ideally strong in Python or TypeScript
- Skilled at finding flaws scanners miss, from authorization and tenant isolation to SSRF and business logic
- Experienced with some mix of SAST, DAST, software composition analysis, container or secrets scanning
- Comfortable using AI coding tools while checking their output carefully
- Self directed in a remote team, able to turn a vague problem into a clear plan
What Close Offers
- Competitive pay plus a company wide goal based bonus (Close does not publish a salary range for this role)
- About 5 weeks of paid time off, a one week winter break and paid US holidays
- An option to work a 4 day week at 80% pay
- Paid parental leave and a one month paid sabbatical every 5 years
- Medical, dental and vision cover and a 401k match up to 6%, vested immediately
- A yearly in person team retreat (Dusseldorf in 2027)
Close's stack includes Python (Flask, FastAPI), TypeScript and React, MongoDB, PostgreSQL, Docker, Kubernetes and AWS.
Apply for the Senior Product Security Engineer role on Close's careers page