Senior Product Security Engineer
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Product Security Engineer securing Close’s AI-powered CRM across applications, APIs, cloud infrastructure, and integrations. Building vulnerability management, security automation, and incident-response capabilities.
Responsibilities:
- Build a recurring product security review program across backend, frontend, APIs, and customer-facing integrations
- Threat-model new features, audit high-risk areas, review code, and build safe proof-of-concepts in isolated development environments
- Improve application security testing using static analysis, dependency and secrets scanning, dynamic testing, and focused automation
- Own vulnerability intake and remediation from HackerOne, scanners, penetration tests, audits, customers, and internal research
- Reproduce issues, assess exploitability and impact, track remediation, and verify fixes
- Serve as technical lead for the bug bounty program
- Automate security-alert ingestion, deduplication, enrichment, prioritization, and routing
- Improve dependency scanning and create safer upgrade and pull-request workflows
- Inventory application secrets, add rotation paths, document runbooks, and automate rotation where appropriate
- Expand Vault-backed dynamic credentials and reduce emergency secret rotations
- Partner with Infrastructure to strengthen AWS security across identity, networking, compute, storage, containers, and registries
- Create secure defaults, just-in-time access patterns, infrastructure guardrails, and actionable remediation
- Support external assessments, audits, SOC 2 goals, documentation, paved roads, and engineering training
- Take a key technical role in security incident response, including investigation, containment, remediation, root-cause analysis, and follow-up improvements
- Report to the Backend Platform team manager within Engineering, Product, and Design while working across the product and infrastructure surface
Requirements:
- USA-only role; must be legally able to work in the US
- Application security engineer who writes code and can move from code analysis to exploit reproduction and production-quality fixes
- Strong Python or TypeScript experience; fluency across backend and frontend systems is advantageous
- Ability to find vulnerabilities conventional scanners may miss
- Experience with authentication, authorization, tenant isolation, injection, SSRF, unsafe data flows, and business logic security
- Ability to threat-model designs, conduct white-box code reviews, and test running systems
- Ability to test like an attacker while protecting customer data and production systems
- Experience with SAST, DAST, software composition analysis, container scanning, secrets scanning, or cloud posture tooling
- Ability to tune security tools, connect them to engineering workflows, and reduce noise
- Experience using coding agents and LLMs while verifying their output
- Ability to assess exploitability, business impact, reachability, existing controls, and attack chains
- Ability to collaborate with product engineers, Site Reliability Engineers, Security & Trust, auditors, and external researchers
- Ability to work self-directed in a remote environment and turn ambiguous security surfaces into practical plans
- Knowledge of Python, TypeScript, React, Flask, FastAPI, GraphQL, Docker, Kubernetes, AWS, Vault, GitHub Actions, MongoDB, PostgreSQL, Redis, Kafka, Elasticsearch, or related security tooling
Benefits:
- Competitive pay plus an organization-wide goal-based bonus
- ~5 weeks of PTO to start
- 1-week all-company Winter Holiday Break
- Paid US holidays
- 2 extra PTO days for every year with Close
- Choice of a standard 5-day week or a 4-day week at 80% pay
- Paid leave for primary and secondary caregivers
- 1-month paid sabbatical every 5 years with the team
- Two medical plans for US residents with Close covering 99% of the premium
- Dental coverage
- Vision coverage
- HSA
- FSA
- Company-paid Long-Term Disability
- 401(k) matching up to 6% for US residents, vested immediately
- Annual in-person company team gatherings/offsites
Similar Jobs
Principal Linux Security Engineer
Principal Linux Security Engineer securing CIQ’s enterprise Linux distributions and infrastructure. Building compliance profiles, security tooling, errata, and CVE assessments for demanding workloads.
Information Security and Governance Analyst, Mid-Level
Analista de Governança e Segurança da Informação apoiando auditorias, riscos e controles na Monkey. Empresa de tecnologia financeira que simplifica transações entre grandes empresas e fornecedores.
Security Engineer IV
Security Engineer IV leading AI/LLM security, cloud controls, compliance, and incident investigations. Rackspace Technology operates enterprise AI infrastructure for regulated and mission-critical customers.
Regional Sales Director, Identity Security
Regional Sales Director leading Mid-Atlantic and TOLA sales teams for Cyera’s AI security platform. Driving territory growth, enterprise deals, coaching, and quota achievement.
Security Engineer
Security Engineer operating Firmable’s SOC 2 and ISO 27001 security controls. Managing AWS cloud security, vulnerabilities, access, monitoring, audits and incident response remotely.
AVP, Cyber Application Security Architect
Cyber application security architect securing SaaS, cloud infrastructure, and software development lifecycles. Driving secure-by-design reviews, DevSecOps, threat modeling, and AI/ML security guidance.
Senior Cybersecurity Disaster Recovery, Contingency Planning SME
Cybersecurity DRCP SME leading nationwide BIA, DRP, and contingency planning programs. Supporting government agencies in strengthening national security and improving public services.
Cloud Specialist – Security SSR
Cloud Security Specialist securing AWS infrastructure for major Latin American companies. Designing AWS governance, network protection, compliance, automation, and incident remediation.
Senior Cybersecurity Architect
Senior Cybersecurity Architect governing Zero Trust, AWS, DevSecOps, and AI security architecture. Reducing cyber risk across HomeServe’s home-services technology and integrations.
Senior Cybersecurity Engineer
Senior Cybersecurity Engineer securing HomeServe’s enterprise systems, infrastructure, and business operations. Leading risk assessments, security architecture, incident response, compliance, and cybersecurity innovation.
AWS Cloud Security Engineer
AWS Cloud Security Engineer securing Peraton’s FedRAMP-authorized AWS infrastructure. Implementing cloud controls, continuous compliance, and ATO support for national security missions.
Security Engineer – CrowdStrike Falcon
Senior CrowdStrike CNAPP engineer configuring cloud, Kubernetes, and container security for a cybersecurity consulting firm. Securing government and enterprise environments through hands-on Falcon implementation.
Technical Advisor II – Food Security, Livelihoods and Markets
Remote CRS technical advisor leading Sudan’s World Bank-funded Food and Nutrition Security Plan. Advising global food security, livelihoods, and market-based humanitarian programming.
Manager, Application Security, SOX
Application Security and SOX Manager securing Oracle Fusion, EPM, and OIC environments. Ensuring access governance, Segregation of Duties, and compliance for Paramount’s global media business.
Senior Manager, Application and Pipeline Security
Senior Manager leading Nielsen’s application and pipeline security for its media insights business. Driving AWS governance, AI-driven DevSecOps, automated remediation, and security engineering team performance.
Senior Security Engineer
Senior Security Engineer monitoring and responding to threats across Cision’s cloud, identity, endpoint, and Linux environments. Cision provides PR, marketing, and social media management technology.
Information Security Control Assurance Analyst
Information security analyst assuring controls, audits, and compliance for Southern New Hampshire University. Managing risk assessments, SSPs, POA&Ms, audits, and governance reporting remotely.
Security Engineer – Manager
Security Engineering Manager leading zero-trust, IAM, collaboration, and AI workspace security for Binance’s global blockchain ecosystem. Building secure platforms and leading distributed engineering teams.
Principal Security Engineer
Principal Security Engineer reviewing FedRAMP cloud architectures, authorization packages, and security controls. Advising government programs and Cloud Service Providers on NIST compliance and risk.
Senior Cybersecurity Risk & Resilience Consultant
Senior cybersecurity risk consultant assessing technology, cloud, and third-party risks. Strengthening risk frameworks and advising stakeholders on resilience, compliance, and remediation.