Security Engineer, Product Security

Responsibilities

• Define security architecture, secure-by-default patterns, and reference implementations for Flexport products and services.
• Lead security reviews for high-risk product features and establish review standards across engineering.
• Build and scale the security champions program and product security training.
• Lead threat modeling and attack surface analysis across the product surface.
• Set standards for triaging, reproducing, and prioritizing bug bounty submissions and internal security reports.
• Drive remediation of systemic vulnerability classes and handle the highest-severity cases.
• Own security services and tooling used by product teams across the global infrastructure.
• Mentor security engineers and act as the authoritative product security voice across engineering leadership.

Requirements

• Typically 2–5 years of experience in product/application security or software development with a security focus.
• Strong understanding of web application security principles and common attack vectors, including the OWASP Top 10.
• Proficiency with application testing tools such as Burp Suite, OWASP ZAP, or browser developer tools.
• Working knowledge of at least one modern programming language such as Ruby, Java, Kotlin, TypeScript, JavaScript, or Python.
• Working knowledge of at least one major cloud provider: AWS, GCP, or Azure.
• Ability to participate in a security on-call rotation and contribute across security disciplines.
• Preferred experience includes bug bounty platforms, SAST tools such as Cycode, Semgrep, or Snyk, cloud infrastructure security, container technologies, CTFs, open-source security projects, threat modeling frameworks, secure SDLC practices, and developer security training.

Benefits

• The role is based in San Francisco with regular office attendance; candidates there or willing to relocate are preferred.
• Relocation support is available for the right candidate.
• Benefits include bonus, equity, medical, dental, and flexible time off.
• Employees receive current hardware and software, including frontier AI models on day one.