Senior Product Security Engineer (USA Only, 100% Remote)

Bazeta; United States; Remote; USD 120,000 - 190,000; Full time

Job summary

Close is seeking a Senior Product Security Engineer (USA Only, 100% remote) to own application and product security across a Python backend, TypeScript frontend, and cloud stack. You will identify vulnerabilities, reproduce exploits, and drive remediation with engineering teams.

You’ll leverage SAST/DAST, container scanning, and cloud‑security tooling while shaping secure design practices across the platform.

Qualifications

• Strong Python or TypeScript experience
• Experience finding vulnerabilities beyond conventional scanners
• Ability to reproduce exploits and ship fixes
• Familiarity with SAST/DAST and container security tooling

Responsibilities

• Identify vulnerabilities across the product surface and prioritize findings
• Provide clear repro steps and actionable remediation guidance
• Develop production‑quality fixes and work with owning teams
• Automate repetitive security tasks and integrate tooling with engineering workflows

Skills

Python

TypeScript

Threat modeling

Vulnerability testing

Automation

Tools

SAST

DAST

Software Composition Analysis

Container Scanning

Cloud Posture Tools

Job description

# Senior Product Security Engineer (USA Only, 100% Remote)United States6 hours agoID 2872513Price on request## DetailsEmployment type: Full-timeRemote: YesCompany: CloseLevel: Senior## DescriptionAbout Us Since 2013, we’ve been building a CRM that gets out of your way and helps your team sell more, faster. Now we’re building AI into every part of it, so Close does the busywork and your team does the selling. No manual data entry, no 10-click workflows. Just communication-first, AI-powered sales software designed to help you succeed and scale. We're bootstrapped and profitable which means we answer to our customers and play by our rules. We're proud of our 120-person, 100% remote team, focused on building Close so that no small, scaling business fails because it can't figure out sales. About the Role Close is a CRM built around the communication tools sales teams use every day: email, calling, SMS, workflows, reporting, and AI. Underneath that product is a broad technical surface — Python services and a large application backend, a TypeScript and React frontend, public APIs, Docker and Kubernetes, AWS infrastructure, and integrations with providers that handle sensitive customer data. Security work happens across it all today, but the ownership is spread across Engineering, Infrastructure, and Security & Trust. We’re hiring our first dedicated Product Security Engineer to make that work systematic. You’ll report to the Backend Platform team manager within EPD (Engineering, Product, and Design), while working across the entire product and infrastructure surface. You’ll find vulnerabilities, determine which findings matter most, and drive them through remediation. Often you’ll fix the problem yourself. Other times you’ll give the owning team a clear reproduction, a practical path forward, and enough context to prioritize correctly. You’ll analyze code, build proof-of-concepts, test running applications, tune or replace noisy tools, and automate the repetitive parts of vulnerability management. This is not a role where you forward scanner alerts and call the queue managed. Product and application security will be your responsibility. You’ll partner closely with our Infrastructure team on cloud security, access, and secrets, and with our Security & Trust Lead on GRC Engineering , compliance (SOC 2) goals, audits, and corporate security. This role is a new one at Close. You’ll have significant room to decide where better tooling, clearer ownership, and a small amount of code can reduce the most risk. Our stack Our backend is primarily Python, with Flask and FastAPI services and TaskTiger and Temporal handling much of our asynchronous work. We expose REST and GraphQL APIs and store data in MongoDB, PostgreSQL, Elasticsearch, and Redis. Our frontend is a large single-page TypeScript application built primarily with React. We bundle with Vite, target modern browsers, and test with Vitest, React Testing Library, Playwright, and Chromatic. The product updates in near real time and uses technologies including WebSockets and WebRTC. Our mobile application is built with React Native. We build and test Docker images in CI/CD and continuously deploy them to Kubernetes on AWS. Our infrastructure uses managed services including EKS, MSK, and ElastiCache, alongside services running on EC2. Terraform and Ansible automate much of the underlying infrastructure, and our containerized local development environment lets engineers run the full system on their own machines. For this role, our stack extends beyond simply backend or frontend: browser behavior, frontend state, API authorization, asynchronous processing, data access, third-party integrations, containers, and cloud configuration can all be part of the same attack path. We love open sourcing our code and ideas on our GitHub and on The Making of Close , our behind-the-scenes Product & Engineering blog. Check out our open source projects like SocketShark , TaskTiger , LimitLion and ciso8601 . AI is both how we build and what we ship, and that's reshaped what engineering looks like. This is a transformation we’re embracing and find deeply exciting. You are • An application security engineer who writes code. You can move from reading an unfamiliar code path, to reproducing an exploit, to proposing or shipping a production-quality fix. Strong Python or TypeScript experience would be especially useful; fluency across both backend and frontend systems is even better. • Skilled at finding vulnerabilities conventional scanners may miss. You use modern AI-assisted review pipelines, guided by expert judgment, to uncover subtle flaws in web apps and APIs—from authentication, authorization, and tenant isolation to injection, SSRF, unsafe data flows, and business logic. You can threat-model designs, white-box review code, and test running systems. • Offensive-minded and operationally responsible. You know how to test like an attacker without being careless with customer data or production systems. You can turn a finding into a safe reproduction, assess exploitability and business impact, and retest the eventual fix. • An automation builder. You have worked with some mix of SAST, DAST, software composition analysis, container scanning, secrets scanning, or cloud posture tooling. More importantly, you know how to tune tools, connect them to engineering workflows, and remove noise. • AI-native and accountable. You use coding agents and LLMs to accelerate investigation, code review, and repetitive engineering work, but you verify their output. You think carefully about what happens when agents clone untrusted code, install dependencies, or receive access to credentials. • Able to separate severity from priority. A score is an input, not a foregone conclusion. You consider reachability, existing controls, customer impact, and attack chains, then explain the risk in language that is legible to an engineer or business owner....