[Hiring] Security Engineer @Flexport

Role Description

Define security architecture for Flexport's products and services, and set the patterns and reference implementations that make secure-by-default the path of least resistance.

• Lead security engineering reviews for the highest-risk product features, and set the bar for what "good" looks like in reviews you don't personally run.
• Build and scale the security champions program and product security training that extend your judgment into teams where you can't be in every review.
• Lead domain-specific threat modeling and attack surface analysis across Flexport's product surface, not just individual features.
• Partner with engineering leadership to resolve the design tradeoffs that a senior engineer would escalate.
• Set the bar for how the team triages, reproduces, and prioritizes bug bounty submissions and internal security reports, and step in on the hardest or highest-severity cases.
• Drive remediation of systemic classes of vulnerability, not just individual findings.
• Own the security services and tooling consumed by product teams across our global infrastructure.
• Mentor other engineers on the team, and act as the authoritative technical voice on product security across engineering leadership.

Qualifications

• Typically 2–5 years of experience in product/application security or software development with a security focus.
• Strong grasp of web application security principles and common attack vectors (e.g., OWASP Top 10).
• Proficiency with application testing tools such as Burp Suite, OWASP ZAP, or browser developer tools.
• Working knowledge of at least one modern programming language (e.g., Ruby, Java/Kotlin, TypeScript/JavaScript, Python) and at least one major cloud provider (AWS, GCP, Azure).
• Comfortable with security on-call rotation and picking up work across security disciplines when needed.

Requirements

• Hands-on experience with bug bounty platforms.
• Hands-on experience with SAST tools (Cycode, Semgrep, Snyk, or similar).
• Experience with cloud infrastructure security and container technologies.
• Participation in CTF events or open-source security projects.
• Familiarity with threat modeling frameworks and secure SDLC best practices.
• Interest in contributing to internal developer security training programs.

Benefits

• Comprehensive benefit offerings such as medical, dental, and flexible time off.
• Bonus and equity opportunities.