Security Engineer, Product Security

Overview

Lead product security architecture, design-time reviews, and vulnerability management for Flexport's products and services, and build the security champions program and developer enablement that extend this work across engineering.

What you'll do

• Define security architecture for Flexport's products and services, and set the patterns and reference implementations that make secure-by-default the path of least resistance.
• Lead security engineering reviews for the highest-risk product features, and set the bar for what "good" looks like in reviews you don't personally run.
• Build and scale the security champions program and product security training that extend your judgment into teams where you can't be in every review.
• Lead domain-specific threat modeling and attack surface analysis across Flexport's product surface, not just individual features.
• Partner with engineering leadership to resolve the design tradeoffs that a senior engineer would escalate.
• Set the bar for how the team triages, reproduces, and prioritizes bug bounty submissions and internal security reports, and step in on the hardest or highest-severity cases.
• Drive remediation of systemic classes of vulnerability, not just individual findings.
• Own the security services and tooling consumed by product teams across our global infrastructure.
• Mentor other engineers on the team, and act as the authoritative technical voice on product security across engineering leadership.

What you'll need

• Typically 2–5 years of experience in product/application security or software development with a security focus; we care more about what you've built than the exact number.
• Strong grasp of web application security principles and common attack vectors (e.g., OWASP Top 10).
• Proficiency with application testing tools such as Burp Suite, OWASP ZAP, or browser developer tools.
• Working knowledge of at least one modern programming language (e.g., Ruby, Java/Kotlin, TypeScript/JavaScript, Python).
• Working knowledge of at least one major cloud provider (AWS, GCP, Azure).
• Comfortable with security on-call rotation and picking up work across security disciplines when needed.

Nice to have

• Hands-on experience with bug bounty platforms.
• Hands-on experience with SAST tools (Cycode, Semgrep, Snyk, or similar).
• Experience with cloud infrastructure security and container technologies.
• Participation in CTF events or open-source security projects.
• Familiarity with threat modeling frameworks and secure SDLC best practices.
• Interest in contributing to internal developer security training programs.

Details

• U.S. remote position.
• Pay range: California $130,950 – $202,125 USD; Washington $147,000 – $183,750 USD; Colorado $148,210 – $163,688 USD; New York City $147,000 – $183,750 USD; Illinois $148,210 – $163,688 USD.