Source Job

• You will build a recurring product security review program, threat-modeling new features and auditing high-risk areas.
• You will improve application security testing by combining static analysis, dependency scanning, and dynamic testing.
• You will own vulnerability intake and remediation, triaging findings from HackerOne, scanners, and internal research.

Close builds a communication-first, AI-powered CRM that automates busywork so sales teams can focus on selling. They are a bootstrapped, profitable 130-person company with a 100% remote team, focused on helping small and scaling businesses succeed.

• Build central security systems and automation the whole company relies on.
• Secure cloud infrastructure, identity and access across Rain's growing footprint.
• Lead external security assessments and drive findings to verified fixes.

Rain is a global stablecoin payments platform for enterprises, neobanks, platforms, developers, and AI agents. Backed by top investors and valued at $1.95B, Rain is a hypergrowth company with a flat, open culture trusted by over 100 organizations worldwide.

• Embed security into every stage of the SDLC ensuring secure-by-design systems.
• Lead secure code reviews across TypeScript/Node.js services and modern frontend stacks.
• Drive threat modeling and own the vulnerability management lifecycle.

SpinQuest is a social casino platform that blends social gaming with innovative currency mechanics. Founded in 2025, we have grown into a recognized name in social gaming with a community-first approach and original content.

• Assist initiatives to support and enhance security in application development processes.
• Conduct internal penetration testing and code reviews.
• Collaborate with software developers to advise on secure coding practices and vulnerability remediation.

Radicle Health is a collection of human services software products designed to foster collaboration and innovation, helping organizations better serve their communities. They offer a supportive culture where employees have real ownership and opportunities for growth.

• Support application security programs including threat modeling and security reviews for web and AI/LLM systems.
• Triage SCA/SAST/DAST/CSPM findings and coordinate remediation with engineering teams.
• Develop automation scripts and tools to integrate security solutions and streamline vulnerability management.

G-P is a leading SaaS-based Global Employment Platform that enables companies to expand into over 180 countries without establishing local entities. With a diverse, remote-first culture, G-P empowers its Dream Team with flexibility and resources to foster innovation and growth.

• Contribute production-grade code across Node.js/React applications and Python/Terraform infrastructure, shipping security fixes directly.
• Drive secure SDLC, CI/CD security automation, and threat modeling across new and existing systems.
• Work AI-natively to secure AI-powered features, own the bug bounty program, and perform hands-on penetration testing.

BioRender builds tools that accelerate scientific communication, helping researchers create and share clear scientific visuals. Backed by Y Combinator and used by millions in 200+ countries, the company is remote-first with a mission-driven, collaborative culture.

• Identify risks through security reviews, code audits, and penetration tests across applications, APIs, and integrations.
• Secure our AI layer against prompt injection, excessive permissions, and unauthorized data access.
• Define and update secure development practices, and support customer security calls.

Euler is an AI-native partner relationship management (PRM) platform that powers go-to-market partnerships, which drive 30-50% of company revenue. We grew 600% last year, are profitable, and have a culture of ownership and no ego.

• Plan, scope, execute, and report on penetration tests across cloud, endpoint, web, and API environments.
• Partner with development teams to embed security testing into their release cycles and mature SDLC practices.
• Lead quarterly red and purple team operations simulating real-world adversaries to test detection and response.

Group 1001 is a consumer-centric, technology-driven family of insurance companies that delivers value by combining financial strength with deep insurance expertise. The culture emphasizes collaboration, communication, risk management, and striving for outcomes, fostering a supportive work environment.

• Design and build well-architected TypeScript features end to end for AML services, including case management and admin panel.
• Lead team-level design reviews, write design docs, and challenge requirements that don’t add up.
• Take part in on-call rotation, debug complex cross-system issues, and mentor engineers to raise the bar.

SEON is the command center for fraud prevention and AML compliance, helping thousands of companies stop fraud and reduce risk. The company is fast-growing, partnering with digital brands like Revolut, Wise, and Bilt.

• Partner with product teams to ensure security is embedded throughout the product development lifecycle.
• Conduct threat modeling, architecture reviews, and source code analysis to identify and mitigate vulnerabilities.
• Automate security processes and drive cross-team projects to closure.

Affirm exists to give people a clear, predictable way to pay over time with no hidden fees, building honest financial products. It is a remote-first company that values information security, transparency, and flexibility, with a strong culture of care.

• Conduct manual pentests on core systems and AI agents, building automation to expand coverage.
• Define how we pentest AI, including LLM applications and agent-generated code.
• Triage SAST findings, review code across web/APIs/AWS, and communicate risk to engineers.

We are a financial technology company based in Boston, unlocking capital for small businesses across America with fast, flexible funding. Our remote-first team, recognized as a Best Place to Work, has provided over $4.8 billion to more than 92,000 small businesses since 2012.

• Define security architecture and set patterns for secure-by-default product design.
• Lead threat modeling and vulnerability management across Flexport's product surface.
• Own security tooling and mentor engineers as the technical authority on product security.

Flexport makes global commerce easy with innovative technology, moving over $19B of merchandise across 112 countries annually. They are a pivotal player in the supply chain crisis, backed by top investors, and focus on mission-driven solutions.

• Serve as mentor to other Security Engineers and lead application security reviews and threat modeling.
• Drive automated security testing and bug bounty program to position 6sense as an industry leader.
• Collaborate with engineering teams to reproduce, triage, and address application security vulnerabilities.

6sense's mission is to multiply growth, retention, and efficiency for companies. They have a growth mindset culture with values like Win as One Team and Stay Curious, and offer numerous learning and development initiatives.

• Lead advanced security assessments across web applications, APIs, cloud platforms, and enterprise networks.
• Conduct red team activities, vulnerability research, and custom tool development to simulate real-world attacks.
• Collaborate with cross-functional teams to assess risks, support remediation, and mentor colleagues.

Hitachi Vantara provides data infrastructure for global innovators across industries. As a diverse, global team, they foster an inclusive culture focused on making a real-world impact with data.

• Lead Olo's Blue Team, providing strategic and technical oversight for information protection, incident detection and response, and security services.
• Own and optimize security programs, including vulnerability management, threat hunting, and non-event driven security reviews.
• Collaborate cross-functionally with customers, partners, and internal teams to strengthen security posture and mitigate risks.

Olo is a leading restaurant technology provider offering digital ordering, payment, and guest engagement solutions for the restaurant industry. It processes millions of orders daily on its open SaaS platform and is trusted by over 800 restaurant brands and 400+ integration partners.

• Threat model token exchange, delegation, and MCP gateway flows to catch credential leaks.
• Build automated security controls for cloud, pipelines, and artifacts; keep credentials short-lived.
• Own incident response and customer security reviews, working with engineers who know the field.

Keycard builds identity and access infrastructure for AI agents, issuing verified, short-lived credentials. It is a remote-first startup backed by a16z, Boldstart, and Acrew, founded by Snyk, Auth0, HashiCorp, and Heroku alumni.

• Plan and run authorized red team operations across cloud, Kubernetes, networks, identity systems, SaaS, and internal applications.
• Build and maintain AI-assisted testing harnesses for automated offensive security testing.
• Work collaboratively with Whatnot’s Blue Team on Purple Team engagements to strengthen security posture.

Whatnot is the largest live shopping platform in North America and Europe. They are one of the fastest growing marketplaces and were named the #1 Best Startup Employer in America, with a culture emphasizing low ego, growth mindset, and high impact.

• Secure Drivetrain's cloud infrastructure (AWS) including IAM, network security, and monitoring.
• Embed security into the SDLC via threat modeling, secure code reviews, and automated scanning.
• Lead vulnerability management, incident response, and compliance programs such as SOC 2 and ISO 27001.

Drivetrain is a financial planning & decision-making platform that helps companies scale and achieve targets predictably. Founded in 2021 by ex-Googlers, it is a remote-first, fast-growing startup backed by leading venture capital firms with a culture focused on autonomy, transparency, and customer-centricity.

• Build scalable demo environments and platform infrastructure to support go-to-market teams.
• Develop full-stack automation and interactive product experiences using cloud and CI/CD tools.
• Partner with engineering and product teams to drive technical vision for demo capabilities.

1Password provides password management and unified access management solutions for businesses. With over 180,000 business customers and $500M ARR, they are a human-centric, remote-first company that values collaboration and transparency.

• Define and evolve AWS infrastructure as code using CDK, applying security and compliance practices for a regulated industry.
• Leverage AI-powered development tools to accelerate code generation, testing, and documentation.
• Collaborate with product management and engineers to design scalable systems and deliver via continuous delivery pipelines.

Pie Insurance empowers small businesses by making commercial insurance affordable and easy as pie through technology. They are a diverse team of builders, dreamers, and entrepreneurs guided by core values and operating principles.