SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Close is a bootstrapped, profitable CRM platform built for sales teams, now integrating AI across the product. The company is 120 people, 100% remote, and founded in 2013.
You will be Close's first dedicated Product Security Engineer, reporting to the Backend Platform team manager within Engineering, Product, and Design. You'll own application and product security across Close's full technical surface: Python backend services (Flask, FastAPI, TaskShark, Temporal), TypeScript/React frontend, GraphQL and REST APIs, Docker/Kubernetes infrastructure on AWS, and integrations with third-party providers handling sensitive customer data.
Your responsibilities span:
**Vulnerability Management & Code Security**: Find vulnerabilities that conventional scanners miss through threat modeling, white-box code review, and testing of running systems. You'll assess exploitability and business impact, reproduce issues safely, and drive remediation to closure—often fixing problems yourself. Cover authentication, authorization, tenant isolation, injection, SSRF, unsafe data flows, and business logic flaws across backend, frontend, APIs, and integrations.
**Security Automation & Tooling**: Build and tune a security testing pipeline combining SAST, DAST, software composition analysis, container scanning, secrets scanning, and cloud posture tools. Automate ingestion, deduplication, enrichment, and routing so engineering teams spend less time interpreting alerts and more time fixing important issues. Reduce noise and connect tools to engineering workflows.
**Vulnerability Intake**: Triage findings from HackerOne, scanners, penetration tests, audits, customers, and internal research. Serve as technical lead for the bug bounty program (contract and budget ownership remain elsewhere).
**Dependency & Secrets Management**: Improve scanning across Python and TypeScript codebases. Build workflows to assess upgrades, stage pull requests, and route work safely without exposing credentials. Partner with Infrastructure to inventory application secrets, add graceful rotation paths, and expand use of Vault-backed dynamic credentials.
**Cloud Security Partnership**: Work with Infrastructure to evaluate and improve automated detection of risky AWS configuration across identity, networking, compute, storage, containers, and registries. Turn findings into secure defaults, just-in-time access patterns, and guardrails—not a second Infrastructure team.
**Security Program Building**: Establish a recurring product security review program. Threat model new features, audit high-risk areas, and build safe proof-of-concepts. Support audits and compliance (SOC 2) goals. Create documentation, paved roads, and lightweight training to help engineers make safer choices.
**Incident Response**: Take a key technical role in security incident response, partnering with Engineering and Infrastructure to coordinate investigation, containment, and remediation.
You'll work across a modern stack: Python, TypeScript, React, Flask, FastAPI, GraphQL, Docker, Kubernetes, AWS, Vault, GitHub Actions, MongoDB, PostgreSQL, Redis, Kafka, Elasticsearch. You'll use AI-assisted code review and coding agents to accelerate investigation and repetitive work, but verify their output carefully.
Close values long-term thinking, transparency, investing in relationships, discipline, and striving for greatness. The company gathers the entire 120-person team in person annually (2027 in Düsseldorf). You'll have significant room to decide where better tooling, clearer ownership, and code can reduce the most risk.
**Requirements:**
- Strong application security engineering background with hands-on code writing ability. You can move from reading unfamiliar code, to reproducing an exploit, to proposing or shipping a production-quality fix.
- Strong Python or TypeScript experience; fluency across both backend and frontend systems is especially valuable.
- Skilled at finding vulnerabilities conventional scanners miss. Experience with threat modeling, white-box code review, and testing running systems.
- Offensive-minded and operationally responsible. You know how to test like an attacker without risking customer data or production systems.
- Experience with SAST, DAST, software composition analysis, container scanning, secrets scanning, or cloud posture tooling. Ability to tune tools, connect them to workflows, and remove noise.
- Comfortable using AI-assisted code review and LLMs to accelerate work, but able to verify output and think carefully about security implications (e.g., agents cloning untrusted code, installing dependencies, accessing credentials).
- Ability to separate severity from priority. You consider reachability, existing controls, customer impact, and attack chains, then explain risk in language legible to engineers and business owners.
- Comfortable collaborating across the business: product engineers, SREs, Security & Trust Lead, auditors, external researchers. You follow findings to closure even when another team owns the fix.
- Self-directed in a remote environment. You can take an ambiguous surface (e.g., secret rotation, dependency remediation) and learn how it works across multiple systems, then turn it into a practical plan with measurable progress.
- You do not need to be the deepest expert in every part of this scope, but you must be able to investigate unfamiliar systems, determine what matters, and bring the right people with you.
