Security Engineer, Product Security

This is a fully remote position, open to applicants in United States.

📋 Description

• Develop and establish the security architecture for Flexport's products and services.

• Create patterns and reference implementations that ensure a secure-by-default approach is the easiest path to follow.

• Oversee security engineering assessments for the most critical product features.

• Build and enhance the security champions program along with product security training initiatives.

• Lead domain-specific threat modeling and analyze attack surfaces across Flexport's product offerings.

• Collaborate with engineering leadership to address senior-level design trade-offs.

• Set criteria for triaging, reproducing, and prioritizing submissions from bug bounty programs and internal security reports.

• Manage the most challenging or highest-severity security issues.

• Propel the remediation of systemic classes of vulnerabilities.

• Take ownership of security services and tools utilized by product teams across global infrastructure.

• Mentor fellow engineers and serve as the authoritative technical resource on product security within engineering leadership.

⛳️ Requirements

• Generally, 2–5 years of experience in product/application security or software development with a security emphasis.

• Solid understanding of web application security principles and prevalent attack vectors (e.g., OWASP Top 10).

• Expertise in application testing tools such as Burp Suite, OWASP ZAP, or browser developer tools.

• Proficient in at least one modern programming language (e.g., Ruby, Java/Kotlin, TypeScript/JavaScript, Python).

• Familiarity with at least one major cloud provider (AWS, GCP, Azure).

• Comfortable with participating in security on-call rotations and taking on tasks across various security disciplines as required.

• Practical experience with bug bounty platforms.

• Hands-on experience with SAST tools (e.g., Cycode, Semgrep, Snyk, or similar).

• Background in cloud infrastructure security and container technologies.

• Involvement in CTF events or contributions to open-source security projects.

• Knowledge of threat modeling frameworks and best practices in secure SDLC.

• Enthusiasm for contributing to internal developer security training programs.

🏝️ Benefits

• Bonus

• Equity

• Comprehensive medical benefits

• Dental benefits

• Flexible time off

• Access to the latest hardware and software

• Availability of frontier AI models from day one

• Participation in security on-call rotations