Staff Security Engineer – Product Security

This is a fully remote position, open to applicants in California, +4 more states.

📋 Description

• Establish the security architecture for Flexport's products and services.

• Create secure-by-default frameworks and reference implementations.

• Oversee security engineering assessments for the most critical product features.

• Develop and expand the security champions initiative along with product security training.

• Direct domain-specific threat modeling and analyze attack surfaces across Flexport's product spectrum.

• Collaborate with engineering leadership to address senior-level design trade-offs.

• Set criteria for evaluating, reproducing, and prioritizing bug bounty submissions and internal security findings.

• Manage the most challenging or severe security incidents.

• Propel the remediation of systemic vulnerability categories.

• Take ownership of security services and tools utilized by product teams within global infrastructure.

• Guide engineers and act as the leading technical authority on product security among engineering leaders.

⛳️ Requirements

• A minimum of 8 years of experience in product/application security.

• Practical experience in developing security tools and services.

• Proven ability to design scalable security architecture across multiple teams and services.

• Strong understanding of web application security fundamentals.

• Practical experience with application testing tools like Burp Suite, OWASP ZAP, or similar.

• Software development experience in creating security tools using at least one modern programming language: Go, Python, Java/Kotlin, TypeScript, Ruby, or similar.

• Demonstrated success in leading technical initiatives across multiple teams and mentoring engineers into senior positions.

• Experience in managing or expanding a security champions program.

• Knowledge of identity management and identity federation using SAML, OAuth, or SCIM.

• Familiarity with IaaS cloud infrastructure, Kubernetes, containers, and service-oriented architectures.

• Practical experience with bug bounty platforms and SAST tools such as Cycode, Semgrep, Snyk, or similar.

• Experience conducting code audits on internal or open-source libraries prior to production deployment.

🏝️ Benefits

• Bonus

• Equity

• Comprehensive medical benefits

• Dental benefits

• Flexible time off

• Latest hardware and software

• Access to frontier AI models from day one