1 month ago
Remote, United StatesSenior
Responsibilities
- Build a recurring product security review program covering threat modeling, code review, high-risk areas, proof-of-concepts, backend, frontend, APIs, and integrations.
- Improve application security testing using static analysis, dependency and secrets scanning, dynamic testing, and focused automation.
- Own vulnerability intake and remediation by triaging, reproducing, prioritizing, tracking, and retesting findings from scanners, audits, penetration tests, customers, HackerOne, and internal research.
- Serve as technical lead for the bug bounty program while following findings through closure.
- Automate security-alert ingestion, deduplication, enrichment, prioritization, and routing.
- Improve dependency-remediation workflows across Python and TypeScript codebases while protecting credentials from untrusted packages and build steps.
- Partner with Infrastructure to inventory secrets, implement graceful rotation paths, document runbooks, and expand Vault-backed dynamic credentials.
- Strengthen AWS security through detection, secure defaults, just-in-time access patterns, infrastructure guardrails, and remediation across identity, networking, compute, storage, containers, and registries.
- Support external assessments and audits, create security documentation and training, and help engineers adopt safer practices.
- Participate in security incident response, including investigation, containment, remediation, root-cause analysis, and follow-up improvements.
Requirements
- Application security engineering experience with the ability to analyze unfamiliar code, reproduce exploits, and ship production-quality fixes.
- Strong Python or TypeScript experience; fluency across backend and frontend systems is advantageous.
- Experience finding vulnerabilities beyond conventional scanner output, including authentication, authorization, tenant isolation, injection, SSRF, unsafe data flows, and business-logic issues.
- Ability to threat-model designs, perform white-box code review, test running systems, and assess exploitability and business impact safely.
- Experience with some combination of SAST, DAST, software composition analysis, container scanning, secrets scanning, or cloud-posture tooling, including tuning and workflow integration.
- Experience with vulnerability management, remediation tracking, security automation, and prioritization based on reachability, controls, customer impact, and attack chains.
- Comfort using coding agents and LLMs for investigation and engineering work while verifying their output and considering risks involving untrusted code, dependencies, and credentials.
- Experience collaborating with product engineers, Site Reliability Engineers, infrastructure teams, auditors, external researchers, and security stakeholders.
- Ability to work independently across ambiguous systems and operate responsibly in a remote environment.
- Experience with or willingness to work across application security, cloud security, secrets management, incident response, audits, and compliance.
Benefits
- Competitive pay plus an organization-wide goal-based bonus.
- Approximately five weeks of PTO to start, a one-week company winter holiday break, paid US holidays, and two additional PTO days for each year of tenure.
- Choice of a standard five-day week or a four-day week at 80% pay, arranged with the manager.
- Paid parental leave for primary and secondary caregivers.
- One-month paid sabbatical every five years.
- For US residents, medical plans with Close covering most of the premium, plus dental, vision, HSA, FSA, and company-paid long-term disability.
- For US residents, 401(k) contribution matching up to 6% with immediate vesting.
- 100% remote role limited to the USA; the company also gathers in person annually.
Tech Stack
AnsibleApache KafkaAWSDockerElasticsearchFastAPIFlaskGitHub ActionsGraphQLKubernetesMongoDBPostgreSQLPythonReactReact NativeRedisTerraformTypeScriptVault
Categories
About Close
Close builds a sales CRM for founders, startups, and small businesses, combining pipeline management with built-in calling, email, SMS, automation, and AI (including its Chloe agent). It sells subscription SaaS that helps inside sales teams communicate with prospects and manage deals from one platform. Founded in 2013 and headquartered in Austin, Texas, Close is privately held, bootstrapped, and profitable.