close - Senior Product Security Engineer (USA Only, 100% Remote)

Remote - USA3w ago

Remote Senior NA Cloud Computing Security Engineer Senior Product Manager Python TypeScript Vault AWS Redis

Responsibilities

• The work spans hands-on application security, security automation, vulnerability management, and infrastructure partnership. Depending on where you find the greatest risk and leverage, projects could include: • Build a recurring product security review program. Threat model new features, audit high-risk areas, review code, and build safe proof-of-concepts in isolated development environments. Work across our backend, frontend, APIs, and customer-facing integrations. • Improve application security testing. Combine static analysis, dependency and secrets scanning, dynamic testing in development, and carefully scoped production testing. Use existing tools where they fit and build focused automation where they don’t. • Own vulnerability intake and remediation. Triage findings from HackerOne, scanners, penetration tests, audits, customers, and internal research. Reproduce issues, assess exploitability and impact, track remediation, and verify fixes. Serve as technical lead for our bug bounty program while contract and budget ownership remain elsewhere. • Turn security alerts into useful engineering work. Verify scanner coverage and automate ingestion, deduplication, enrichment, prioritization, and routing—so teams spend less time interpreting alerts and more time fixing important issues. • Make dependency remediation safer and less manual. Improve scanning across our Python and TypeScript codebases, then build workflows to assess upgrades, stage pull requests, run checks, and route work without exposing credentials to untrusted packages or build steps. • Make secrets routinely rotatable. Partner with service owners and Infrastructure to inventory application secrets, add graceful rotation paths, document provider-specific runbooks, and automate rotation where the provider and risk justify it. Expand our use of Vault-backed dynamic credentials and reduce the number of rotations that require a coordinated fire drill. • Strengthen AWS security with Infrastructure. Evaluate and improve automated detection of risky configuration across identity, networking, compute, storage, containers, and registries. Turn findings into secure defaults, just-in-time access patterns, infrastructure guardrails, and actionable remediation—not build a second Infrastructure team. • Support audits and raising the security floor. Partner with Security & Trust on external assessments, provide technical context, and ensure findings are fixed rather than rediscovered. Along the way, create documentation, paved roads, and lightweight training that helps engineers make safer choices without waiting for a security review. • Take a key technical role in security incident response. Partner with Engineering and Infrastructure to coordinate investigation, containment, and remediation. Contribute to root-cause analysis and follow-up improvements, translating lessons learned into stronger controls and reduced recurrence. • Tech you’ll touch: Python, TypeScript, React, Flask, FastAPI, GraphQL, Docker, Kubernetes, AWS, Vault, GitHub Actions, MongoDB, PostgreSQL, Redis, Kafka, Elasticsearch and the security tooling you help us choose. • Build a house you want to live in - Examine long-term thinking and action • No BS - Practice transparency and honesty, especially when it’s hard • Invest in each other - Build successful relationships with your coworkers and customers • Discipline equals freedom - Keep your word to yourself and others • Strive for greatness - Constantly challenge yourself and others • Listen to our CEO and Founder, Steli Efti, tell the story of Close’s journey in the $0-30m Blueprint https://www.close.com/blueprint. • Watch our culture video https://www.youtube.com/watch?v=maXKi1GN2MI from our 2023 team retreat in Milan. Every year our entire team gathers in person to build connection, foster cross-functional collaboration, and have fun. In 2027, we're headed to Dusseldorf, Germany! • Explore our product. Check out a demo https://www.close.com/demo-site! • OUR HIRING PROCESS • We ask a few role-specific questions as part of our application process. These questions are designed to help us learn more about you from the start, so please answer each one thoughtfully. We see this as an opportunity to get to know you beyond your resume. • We use AI tools daily at Close and expect candidates to do the same. In evaluating your application, we aim to get a sense for you - the way you think, how you communicate, the work you've done. Applications that read as fully AI-generated will not be considered. • Regardless of fit, you can expect to hear back from our team with an update on the status of your candidacy. • If you progress to the interview process, you'll receive a full outline of the role-specific steps in your first touchpoint with us. We do our best to make the hiring process clear and human.

Benefits

• Compensation: Competitive pay plus an organization-wide goal-based bonus • Paid Time Off: ~5 weeks of PTO to start. Plus a 1-week all-company Winter Holiday Break and paid US holidays. You'll earn 2 extra days for every year you're with Close. • 80% Work Option: Work with your manager to choose between a standard 5-day week or a 4-day week at 80% pay • Parental Leave: Paid leave for primary and secondary caregivers • Sabbatical: A 1-month paid sabbatical every 5 years with the team • Healthcare (US residents): Two medical plans with Close covering the majority of your premium, plus Dental, Vision, HSA, FSA, and company-paid Long-Term Disability • 401k (US residents): We match your contributions up to 6%, vested immediately • Build a house you want to live in - Examine long-term thinking and action • No BS - Practice transparency and honesty, especially when it’s hard • Invest in each other - Build successful relationships with your coworkers and customers • Discipline equals freedom - Keep your word to yourself and others • Strive for greatness - Constantly challenge yourself and others • Listen to our CEO and Founder, Steli Efti, tell the story of Close’s journey in the $0-30m Blueprint. • Watch our culture video from our 2023 team retreat in Milan. Every year our entire team gathers in person to build connection, foster cross-functional collaboration, and have fun. In 2027, we're headed to Dusseldorf, Germany! • Explore our product. Check out a demo! • Our Hiring Process • We ask a few role-specific questions as part of our application process. These questions are designed to help us learn more about you from the start, so please answer each one thoughtfully. We see this as an opportunity to get to know you beyond your resume. • We use AI tools daily at Close and expect candidates to do the same. In evaluating your application, we aim to get a sense for you - the way you think, how you communicate, the work you've done. Applications that read as fully AI-generated will not be considered. • Regardless of fit, you can expect to hear back from our team with an update on the status of your candidacy. • If you progress to the interview process, you'll receive a full outline of the role-specific steps in your first touchpoint with us. We do our best to make the hiring process clear and human.