The opportunity
Close is a CRM built around the communication tools sales teams use every day: email, calling, SMS, workflows, reporting, and AI. Underneath that product is a broad technical surface — Python services and a large application backend, a TypeScript and React frontend, public APIs,…
What you'll do
An application security engineer who writes code. You can move from reading: an unfamiliar code path, to reproducing an exploit, to proposing or shipping a production-quality fix. Strong Python or TypeScript experience would be especially useful; fluency across both backend and frontend systems is even better.
Skilled at finding vulnerabilities conventional scanners may miss. You use: modern AI-assisted review pipelines, guided by expert judgment, to uncover subtle flaws in web apps and APIs—from authentication, authorization, and tenant isolation to injection, SSRF, unsafe data flows, and business logic. You can threat-model designs, white-box review code, and test running systems.
Offensive-minded and operationally responsible. You know how to test like an: attacker without being careless with customer data or production systems. You can turn a finding into a safe reproduction, assess exploitability and business impact, and retest the eventual fix.
An automation builder. You have worked with some mix of SAST, DAST, software: composition analysis, container scanning, secrets scanning, or cloud posture tooling. More importantly, you know how to tune tools, connect them to engineering workflows, and remove noise.
AI-native and accountable. You use coding agents and LLMs to accelerate: investigation, code review, and repetitive engineering work, but you verify their output. You think carefully about what happens when agents clone untrusted code, install dependencies, or receive access to credentials.
Able to separate severity from priority. A score is an input, not a foregone: conclusion. You consider reachability, existing controls, customer impact, and attack chains, then explain the risk in language that is legible to an engineer or business owner.
What they're looking for
- Comfortable working across the business. You’ll collaborate with product: engineers, Site Reliability Engineers, Security & Trust Lead, auditors, and external researchers without confusing partnership for pass-off ownership. You will follow findings to closure even when another team is responsible for the fix.
- Self-directed in a remote environment. You can take an ambiguous surface: (say, secret rotation or dependency remediation) and learn how it works across multiple systems then turn it into a practical plan with measurable progress.
- Build a recurring product security review program. Threat model new features,: audit high-risk areas, review code, and build safe proof-of-concepts in isolated development environments. Work across our backend, frontend, APIs, and customer-facing integrations.
- Improve application security testing. Combine static analysis, dependency and: secrets scanning, dynamic testing in development, and carefully scoped production testing. Use existing tools where they fit and build focused automation where they don’t.
